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The following material is a review of the Operational and Integrated Risk Management 
principles designed to address the learning objectives set forth by the Global Association of Risk 
Professionals. 


Reading Assignments 

37. “Principles for the Sound Management of Operational Risk,” (Basel Committee on 

Banking Supervision Publication, June 2011). (page 1) 

38. Brian Nocco and Rene Stulz, “Enterprise Risk Management: Theory and Practice,” 

Journal of Applied Corporate Finance 18, No. 4 (2006): 8-20. (page 15) 

39. “Observations on Developments in Risk Appetite Frameworks and IT Infrastructure,” 

Senior Supervisors Group, December 2010. (page 25) 

Anthony Tarantino and Deborah Cernauskas, Risk Management in Finance: Six Sigma 
and Other Next Generation Techniques (Hoboken, NJ: John Wiley & Sons, 2009). 

40. “Information Risk and Data Quality Management,” Chapter 3 (page 35) 

Marcelo G. Cruz, Gareth W. Peters, and Pavel V. Shevchenko, Fundamental Aspects of 
Operational Risk and Insurance Analytics: A Handbook of Operational Risk (Hoboken, NJ: 
John Wiley & Sons, 2015). 

41. “OpRisk Data and Governance,” Chapter 2 (page 43) 

Philippa X. Girling, Operational Risk Management: A Complete Guide to a Succesful 
Operational Risk Framework (Hoboken, NJ: John Wiley & Sons, 2013). 

42. “External Loss Data,” Chapter 8 (page 61) 

43. “Capital Modeling,” Chapter 12 (page 73) 

44. “Standardized Measurement Approach for Operational Risk—Consultative Document,” 

(Basel Committee on Banking Supervision Publication, March 2016). (page 86) 

Kevin Dowd, Measuring Market Risk, 2nd Edition (West Sussex, UK: John Wiley & 
Sons, 2005). 

45. “Parametric Approaches (II): Extreme Value,” Chapter 7 (p^g^ 96) 

Giacomo De Laurentis, Renato Maino, and Luca Molteni, Developing, Validating and 
Using Internal Ratings (Hoboken, NJ: John Wiley & Sons, 2010). 

46. “Validating Rating Models,” Chapter 5 (page 104) 


©2018 Kaplan, Inc. 


Page v 




Book 3 

Reading Assignments and Learning Objectives 


Michel Crouhy, Dan Galai and Robert Mark, The Essentials of Risk Management, 2nd 
Edition (New York, NY: McGraw-Hill, 2014). 

47. “Model Risk,” Ghapter 15 116) 

48. “Risk Capital Attribution and Risk-Adjusted Performance Measurement,” 

Chapter 17 128) 

49. “Range of Practices and Issues in Economic Capital Frameworks,” (Basel Committee on 

Banking Supervision Publication, March 2009). (p^c 146) 

50. “Capital Planning at Large Bank Holding Companies: Supervisory Expectations 

and Range of Current Practice,” Board of Governors of the Federal Reserve System, 
August 2013. (p^^ 164) 

Bruce Tuckman and Angel Serrat, Fixed Income Securities: Tools for Todays Markets, 

3rd Edition (Hoboken, NJ: John Wiley & Sons, 2011) 

51. “Repurchase Agreements and Financing,” Chapter 12 (p^e 178) 

Kevin Dowd, Measuring Market Risk, 2nd Edition (West Sussex, UK: John 
Wiley & Sons, 2005). 

52. “Estimating Liquidity Risks,” Chapter 14 (p^^ 192) 

Allan Malz, Financial Risk Management: Models, History, and Institutions (Hoboken, NJ: 
John Wiley & Sons, 2011). 

53. “Assessing the Quality of Risk Measures,” Chapter 11 (p^e 206) 

54. “Liquidity and Leverage,” Chapter 12 (p^^ 216) 

55. Darrell Duffie, 2010. “The Failure Mechanics of Dealer Banks,” Journal of Economic 

Perspectives 24:1, 51-72. (p^ge 237) 

56. Til Schuermann, “Stress Testing Banks,” prepared for the Committee on Capital Market 

Regulation, Wharton Financial Institutions Center (April 2012). (p^^ 248) 

57: “Guidance on Managing Outsourcing Risk,” Board of Governors of the Federal Reserve 
System, December 2013. (p^^ 259) 

John C. Hull, Risk Management and Financial Institutions, 4th Edition (Hoboken, NJ: 
John Wiley & Sons, 2015). 

58. “Basel I, Basel II, and Solvency II,” Chapter 15 (p^^ 267) 

59. “Basel 11.5, Basel III, and Other Post-Crisis Changes,” Chapter 16 (p^^ 290) 

60. “Fundamental Review of the Trading Book,” Chapter 17 (p^^ 307) 

61. “Sound Management of Risks Related to Money Laundering and Financing of 

Terrorism,” (Basel Committee on Banking Supervision, June 2017). (p^^ 316) 
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37. Principles for the Sound Management of Operational Risk 

After completing this reading, you should be able to: 

1. Describe the three “lines of defense” in the Basel model for operational risk 
governance, (page 1) 

2. Summarize the fundamental principles of operational risk management as suggested 
by the Basel committee, (page 2) 

3. Explain guidelines for strong governance of operational risk, and evaluate the role 
of the board of directors and senior management in implementing an effective 
operational risk framework, (page 3) 

4. Describe tools and processes that can be used to identify and assess operational risk, 
(page 7) 

5. Describe features of an effective control environment and identify specific controls 
that should be in place to address operational risk, (page 7) 

6. Explain the Basel Committees suggestions for managing technology risk and 
outsourcing risk, (page 8) 

38. Enterprise Risk Management: Theory and Practice 

After completing this reading, you should be able to: 

1. Define enterprise risk management (ERM) and explain how implementing ERM 
practices and policies can create shareholder value, both at the macro and the micro 
level, (page 15) 

2. Explain how a company can determine its optimal amount of risk through the use 
of credit rating targets, (page 17) 

3. Describe the development and implementation of an ERM system, as well as 
challenges to the implementation of an ERM system, (page 17) 

4. Describe the role of and issues with correlation in risk aggregation, and describe 
typical properties of a firms market risk, credit risk, and operational risk 
distributions, (page 18) 

5. Distinguish between regulatory and economic capital, and explain the use of 
economic capital in the corporate decision making process, (page 19) 

39. Observations on Developments in Risk Appetite Frameworks and IT Infrastructure 

After completing this reading, you should be able to: 

1. Describe the concept of a risk appetite framework (RAF), identify the elements 
of an RAF, and explain the benefits to a firm of having a well-developed RAF. 

(page 25) 

2. Describe best practices for a firms Chief Risk Officer (CRO), Chief Executive 
Officer (CEO), and its board of directors in the development and implementation 
of an effective RAF. (page 26) 

3. Explain the role of an RAF in managing the risk of individual business lines within 
a firm, and describe best practices for monitoring a firms risk profile for adherence 
to the RAF. (page 27) 

4. Explain the benefits to a firm from having a robust risk data infrastructure, and 
describe key elements of an effective IT risk management policy at a firm, (page 28) 

5. Describe factors that can lead to poor or fragmented IT infrastructure at an 
organization, (page 29) 

6. Explain the challenges and best practices related to data aggregation at an 
organization, (page 30) 
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40. Information Risk and Data Quality Management 

After completing this reading, you should be able to: 

1. Identify the most common issues that result in data errors, (page 36) 

2. Explain how a firm can set expectations for its data quality and describe some key 
dimensions of data quality used in this process, (page 36) 

3. Describe the operational data governance process, including the use of scorecards in 
managing information risk, (page 38) 

41. OpRisk Data and Governance 

After completing this reading, you should be able to: 

1. Describe the seven Basel II event risk categories and identify examples of 
operational risk events in each category, (page 43) 

2. Summarize the process of collecting and reporting internal operational loss data, 
including the selection of thresholds, the timeframe for recoveries, and reporting 
expected operational losses, (page 46) 

3. Explain the use of a Risk Control Self-Assessment (RCSA) and key risk indicators 
(KRIs) in identifying, controlling, and assessing operational risk exposures. 

(page 48) 

4. Describe and assess the use of scenario analysis in managing operational risk, and 
identify biases and challenges that can arise when using scenario analysis, (page 51) 

5. Compare the typical operational risk profiles of firms in different financial sectors, 
(page 53) 

6. Explain the role of operational risk governance and explain how a firms 
organizational structure can impact risk governance, (page 56) 

42. External Loss Data 

After completing this reading, you should be able to: 

1. Explain the motivations for using external operational loss data and common 
sources of external data, (page 61) 

2. Explain ways in which data from different external sources may differ, (page 64) 

3. Describe the challenges that can arise through the use of external data, (page 65) 

4. Describe the Societe Generale operational loss event and explain the lessons learned 
from the event, (page 66) 

43. Capital Modeling 

After completing this reading, you should be able to: 

1. Compare the basic indicator approach, the standardized approach, and the 
alternative standardized approach for calculating the operational risk capital charge, 
and calculate the Basel operational risk charge using each approach, (page 73) 

2. Describe the modeling requirements for a bank to use the Advanced Measurement 
Approach (AMA). (page 78) 

3. Describe the loss distribution approach to modeling operational risk capital. 

(page 79) 

4. Explain how frequency and severity distributions of operational losses are obtained, 
including commonly used distributions and suitability guidelines for probability 
distributions, (page 79) 

5. Explain how Monte Carlo simulation can be used to generate additional data points 
to estimate the 99.9*^*^ percentile of an operational loss distribution, (page 81) 

6. Explain the use of scenario analysis and the hybrid approach in modeling 
operational risk capital, (page 81) 
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44. Standardized Measurement Approach for Operational Risk 

After completing this reading, you should be able to: 

1. Explain the elements of the proposed Standardized Measurement Approach (SMA), 
including the business indicator, internal loss multiplier and loss component, 

and calculate the operational risk capital requirement for a bank using the SMA. 

(page 86) 

2. Compare the SMA to earlier methods of calculating operational risk capital, 
including the Alternative Measurement Approaches (AMA), and explain the 
rationale for the proposal to replace them, (page 90) 

3. Describe general and specific criteria recommended by the Basel Committee for the 
identification, collection, and treatment of operational loss data, (page 91) 

45. Parametric Approaches (II): Extreme Value 

After completing this reading, you should be able to: 

1. Explain the importance and challenges of extreme values in risk management. 

(page 96) 

2. Describe extreme value theory (EVT) and its use in risk management, (page 96) 

3. Describe the peaks-over-threshold (POT) approach, (page 98) 

4. Compare and contrast generalized extreme value and POT. (page 100) 

5. Evaluate the tradeoffs involved in setting the threshold level when applying the GP 
distribution, (page 98) 

6. Explain the importance of multivariate EVT for risk management, (page 100) 

46. Validating Rating Models 

After completing this reading, you should be able to: 

1. Explain the process of model validation and describe best practices for the roles of 
internal organizational units in the validation process, (page 104) 

2. Compare qualitative and quantitative processes to validate internal ratings, and 
describe elements of each process, (page 107) 

3. Describe challenges related to data quality and explain steps that can be taken to 
validate a models data quality, (page 109) 

4. Explain how to validate the calibration and the discriminatory power of a rating 
model, (page 111) 

47. Model Risk 

After completing this reading, you should be able to: 

1. Identify and explain errors in modeling assumptions that can introduce model risk. 

(page 116) 

2. Explain how model risk can arise in the implementation of a model, (page 118) 

3. Explain methods and procedures risk managers can use to mitigate model risk. 

(page 119) 

4. Explain the impact of model risk and poor risk governance in the 2012 London 
Whale trading loss and the 1998 collapse of Long Term Capital Management. 

(page 120) 
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48. Risk Capital Attribution and Risk-Adjusted Performance Measurement 
After completing this reading, you should be able to: 

1. Define, compare, and contrast risk capital, economic capital, and regulatory capital, 
and explain methods and motivations for using economic capital approaches to 
allocate risk capital, (page 128) 

2. Describe the RAROC (risk-adjusted return on capital) methodology and its use in 
capital budgeting, (page 130) 

3. Compute and interpret the RAROC for a project, loan, or loan portfolio, and use 
RAROC to compare business unit performance, (page 130) 

4. Explain challenges that arise when using RAROC for performance measurement, 
including choosing a time horizon, measuring default probability, and choosing a 
confidence level, (page 133) 

5. Calculate the hurdle rate and apply this rate in making business decisions using 
RAROC. (page 135) 

6. Compute the adjusted RAROC for a project to determine its viability, (page 136) 

7. Explain challenges in modeling diversification benefits, including aggregating 
a firms risk capital and allocating economic capital to different business lines. 

(page 136) 

8. Explain best practices in implementing an approach that uses RAROC to allocate 
economic capital, (page 138) 

49. Range of Practices and Issues in Economic Capital Frameworks 
After completing this reading, you should be able to: 

1. Within the economic capital implementation framework describe the challenges 
that appear in: 

• Defining and calculating risk measures 

• Risk aggregation 

• Validation of models 

• Dependency modeling in credit risk 

• Evaluating counterparty credit risk 

• Assessing interest rate risk in the banking book (page 146) 

2. Describe the BIS recommendations that supervisors should consider to make 
effective use of internal risk measures, such as economic capital, that are not 
designed for regulatory purposes, (page 156) 

3. Explain benefits and impacts of using an economic capital framework within the 
following areas: 

• Credit portfolio management 

• Risk based pricing 

• Customer profitability analysis 

• Management incentives (page 157) 

4. Describe best practices and assess key concerns for the governance of an economic 
capital framework, (page 158) 

50. Capital Planning at Large Bank Holding Companies: Supervisory Expectations and 
Range of Current Practice 

After completing this reading, you should be able to: 

1. Describe the Federal Reserves Capital Plan Rule and explain the seven principles of 
an effective capital adequacy process for bank holding companies (BHCs) subject to 
the Capital Plan Rule, (page 164) 
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2. Describe practices that can result in a strong and effective capital adequacy process 
for a BHC in the following areas: 

• Risk identification 

• Internal controls, including model review and valuation 

• Corporate governance 

• Capital policy, including setting of goals and targets and contingency planning 

• Stress testing and stress scenario design 

• Estimating losses, revenues, and expenses, including quantitative and qualitative 
methodologies 

• Assessing the impact of capital adequacy, including risk-weighted asset (RWA) 
and balance sheet projections (page 166) 

51. Repurchase Agreements and Financing 

After completing this reading, you should be able to: 

1. Describe the mechanics of repurchase agreements (repos) and calculate the 
settlement for a repo transaction, (page 178) 

2. Explain common motivations for entering into repos, including their use in cash 
management and liquidity management, (page 179) 

3. Explain how counterparty risk and liquidity risk can arise through the use of repo 
transactions, (page 181) 

4. Assess the role of repo transactions in the collapses of Lehman Brothers and Bear 
Stearns during the (2007-2009) credit crisis, (page 182) 

5. Compare the use of general and special collateral in repo transactions, (page 183) 

6. Describe the characteristics of special spreads and explain the typical behavior of 
US Treasury special spreads over an auction cycle, (page 185) 

7. Calculate the financing advantage of a bond trading special when used in a repo 
transaction, (page 186) 

52. Estimating Liquidity Risks 

After completing this reading, you should be able to: 

1. Define liquidity risk and describe factors that influence liquidity, including the bid- 
ask spread, (page 192) 

2. Differentiate between exogenous and endogenous liquidity, (page 193) 

3. Describe the challenges of estimating liquidity-adjusted VaR (LVaR). (page 193) 

4. Describe and calculate LVaR using the constant spread approach and the exogenous 
spread approach, (page 194) 

5. Describe endogenous price approaches to LVaR, their motivation and limitations, 
and calculate the elasticity-based liquidity adjustment to VaR. (page 197) 

6. Describe liquidity at risk (LaR) and compare it to LVaR and VaR, describe the 
factors that affect future cash flows, and explain challenges in estimating and 
modeling LaR. (page 199) 

7. Describe approaches to estimate liquidity risk during crisis situations and challenges 
which can arise during this process, (page 200) 

53. Assessing the Quality of Risk Measures 

After completing this reading, you should be able to: 

1. Describe ways that errors can be introduced into models, (page 206) 

2. Explain how model risk and variability can arise through the implementation of 
VaR models and the mapping of risk factors to portfolio positions, (page 207) 
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3. Identify reasons for the failure of the long-equity tranche, short-mezzanine credit 
trade in 2005 and describe how such modeling errors could have been avoided, 
(page 209) 

4. Explain major defects in model assumptions that led to the underestimation of 
systematic risk for residential mortgage backed securities (RMBS) during the 2007- 
2009 financial downturn, (page 211) 

54. Liquidity and Leverage 

After completing this reading, you should be able to: 

1. Differentiate between sources of liquidity risk, including balance sheet/funding 
liquidity risk, systematic funding liquidity risk, and transactions liquidity risk, and 
explain how each of these risks can arise for financial institutions, (page 216) 

2. Summarize the asset-liability management process at a fractional reserve bank, 
including the process of liquidity transformation, (page 217) 

3. Describe specific liquidity challenges faced by money market mutual funds and by 
hedge funds, particularly in stress situations, (page 219) 

4. Compare transactions used in the collateral market and explain risks that can arise 
through collateral market transactions, (page 220) 

5. Describe the relationship between leverage and a firms return profile, calculate the 
leverage ratio, and explain the leverage effect, (page 222) 

6. Explain the impact on a firms leverage and its balance sheet of the following 
transactions: purchasing long equity positions on margin, entering into short sales, 
and trading in derivatives, (page 224) 

7. Explain methods to measure and manage funding liquidity risk and transactions 
liquidity risk, (page 228) 

8. Calculate the expected transactions cost and the spread risk factor for a transaction, 
and calculate the liquidity adjustment to VaR for a position to be liquidated over a 
number of trading days, (page 229) 

9. Explain interactions between different types of liquidity risk and explain how 
liquidity risk events can increase systemic risk, (page 216) 

55. The Failure Mechanics of Dealer Banks 

After completing this reading, you should be able to: 

1. Describe the major lines of business in which dealer banks operate and the risk 
factors they face in each line of business, (page 237) 

2. Identify situations that can cause a liquidity crisis at a dealer bank and explain 
responses that can mitigate these risks, (page 241) 

3. Describe policy measures that can alleviate firm-specific and systemic risks related to 
large dealer banks, (page 244) 

56. Stress Testing Banks 

After completing this reading, you should be able to: 

1. Describe the historical evolution of the stress testing process and compare 
methodologies of historical EBA, CCAR and SCAP stress tests, (page 249) 

2. Explain challenges in designing stress test scenarios, including the problem of 
coherence in modeling risk factors, (page 250) 

3. Explain challenges in modeling a banks revenues, losses, and its balance sheet over a 
stress test horizon period, (page 251) 
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57. Guidance on Managing Outsourcing Risk 

After completing this reading, you should be able to: 

1. Explain how risks can arise through outsourcing activities to third-party service 
providers, and describe elements of an effective program to manage outsourcing 
risk, (page 259) 

2. Explain how financial institutions should perform due diligence on third-party 
service providers, (page 260) 

3. Describe topics and provisions that should be addressed in a contract with a third- 
party service provider, (page 261) 

58. Basel I, Basel II, and Solvency II 

After completing this reading, you should be able to: 

1. Explain the motivations for introducing the Basel regulations, including key risk 
exposures addressed, and explain the reasons for revisions to Basel regulations over 
time, (page 267) 

2. Explain the calculation of risk-weighted assets and the capital requirement per the 
original Basel I guidelines, (page 268) 

3. Describe and contrast the major elements—including a description of the risks 
covered—of the two options available for the calculation of market risk capital: 

• Standardized Measurement Method 

• Internal Models Approach (page 271) 

4. Calculate VaR and the capital charge using the internal models approach, and 
explain the guidelines for backtesting VaR. (page 272) 

5. Describe and contrast the major elements of the three options available for the 
calculation of credit risk capital: 

• Standardized Approach 

• Foundation IRB Approach 

• Advanced IRB Approach (page 274) 

6. Describe and contrast the major elements of the three options available for the 
calculation of operational risk capital: basic indicator approach, standardized 
approach, and the Advanced Measurement Approach, (page 280) 

7. Describe the key elements of the three pillars of Basel II: minimum capital 
requirements, supervisory review, and market discipline, (page 280) 

8. Define in the context of Basel II and calculate the worst-case default rate (WCDR). 
(page 274) 

9. Differentiate between solvency capital requirements (SCR) and minimum capital 
requirements (MCR) in the Solvency II framework, and describe the repercussions 
to an insurance company for breaching the SCR and MCR. (page 282) 

10. Compare the standardized approach and the Internal Models Approach for 
calculating the SCR in Solvency II. (page 282) 

59. Basel 11.5, Basel III, and Other Post-Crisis Changes 
After completing this reading, you should be able to: 

1. Describe and calculate the stressed VaR measure introduced in Basel 2.5, and 
calculate the market risk capital charge, (page 290) 

2. Explain the process of calculating the incremental risk capital charge for positions 
held in a banks trading book, (page 292) 

3. Describe the comprehensive risk measure (CRM) for positions that are sensitive to 
correlations between default risks, (page 292) 
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4. Define in the context of Basel III and calculate where appropriate. 

• Tier 1 capital and its components 

• Tier 2 capital and its components 

• Required Tier 1 equity capital, total Tier 1 capital, and total capital (page 294) 

5. Describe the motivations for and calculate the capital conservation buffer and the 
countercyclical buffer introduced in Basel III. (page 295) 

6. Describe and calculate ratios intended to improve the management of liquidity risk, 
including the required leverage ratio, the liquidity coverage ratio, and the net stable 
funding ratio, (page 296) 

7. Describe the mechanics of contingent convertible bonds (CoCos) and explain the 
motivations for banks to issue them, (page 299) 

8. Explain the major changes to the US financial market regulations as a result of 
Dodd-Frank, (page 300) 

60. Fundamental Review of the Trading Book 

After completing this reading, you should be able to: 

1. Describe the proposed changes to the Basel market risk capital calculation and 
the motivations for these changes, and calculate the market risk capital under this 
method, (page 307) 

2. Compare the various liquidity horizons proposed by the Fundamental Review of 
the Trading Book (FRTB) for different asset classes and explain how a bank can 
calculate its expected shortfall using the various horizons, (page 309) 

3. Explain proposed modifications to Basel regulations in the following areas: 

• Classification of positions in the trading book compared to the banking book 

• Treatment of credit spread and jump-to-default risk, including the incremental 
default risk charge (page 311) 

61. Sound Management of Risks Related to Money Laundering and Financing 
of Terrorism 

After completing this reading, you should be able to: 

1. Explain best practices recommended by the Basel Committee for the assessment, 
management, mitigation, and monitoring of money laundering and financial 
terrorism (ML/FT) risks, (page 316) 

2. Describe recommended practices for the acceptance, verification, and identification 
of customers at a bank, (page 318) 

3. Explain practices for managing ML/FT risks in a group-wide and cross-border 
context, and describe the roles and responsibilities of supervisors in managing these 
risks, (page 320) 

4. Explain policies and procedures a bank should use to manage ML/FT risks in 
situations where it uses a third party to perform customer due diligence and when 
engaging in correspondent banking, (page 322) 


Page xiv 


©2018 Kaplan, Inc. 



The following is a review of the Operational and Integrated Risk Management principles designed to address 
the learning objectives set forth by GARP®. This topic is also covered in: 


Principles for the Sound 
Management of Operational Risk 


Topic 37 


Exam Focus 

This is a descriptive topic that addresses the principles of sound operational risk management 
as proposed by the Basel Committee on Banking Supervision. The committee describes a 
three lines of defense approach, which includes business line management, independent 
operational risk management, and independent reviews. The committee suggests that a 
bank should have a corporate operational risk function (CORF) that is commensurate 
with the size and complexity of the banking organization. For the exam, understand the 11 
principles of operational risk management as outlined by the Basel Committee. Know the 
specific responsibilities of the board of directors and senior managers as they relate to the 11 
principles of operational risk management. Be able to explain the critical components of the 
banks operational risk management framework documentation, and know the features of 
an effective control environment. Lastly, understand the committees recommendations for 
managing technology and outsourcing risk. 


Operational Risk Governance 


LO 37.1: Describe the three “lines of defense” in the Basel model for operational 
risk governance. 


The Basel Committee on Banking Supervision defines operational risk as “the risk of loss 
resulting from inadequate or failed internal processes, people and systems or from external 
events.” The committee states that the definition excludes strategic and reputational risks 
but includes legal risks. Operational risk is inherent in banking activities. Risks range from 
those arising from national disasters, such as hurricanes, to the risk of fraud. The committee 
intends to improve operational risk management throughout the banking system. 

Sound operational risk management practices cover governance, the risk management 
environment, and the role of disclosure. Operational risk management must be fully 
integrated into the overall risk management processes of the bank. 

The three common “lines of defense” employed by firms to control operational risks are: 

1. Business line management. Business line management is the first line of defense. 

Banks now, more than ever, have multiple lines of business, all with varying degrees of 
operational risk. Risks must be identified and managed within the various products, 
activities, and processes of the bank. 
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2. An independent operational risk management function. This is the second line of 
defense and is discussed in the next section. 

3. Independent reviews of operational risks and risk management. The review may 
be conducted internally with personnel independent of the process under review or 
externally. 

Corporate Operational Risk Function (CORF) 

The banks specific business lines monitor, measure, report, and manage operational 
and other risks. The corporate operational risk function (CORF), also known as the 
corporate operational risk management function, is a functionally independent group that 
complements the business lines risk management operations. The CORF is responsible 
for designing, implementing, and maintaining the banks operational risk framework. 
Responsibilities of the CORF may include: 

• Measurement of operational risks. 

• Establishing reporting processes for operational risks. 

• Establishing risk committees to measure and monitor operational risks. 

• Reporting operational risk issues to the board of directors. 

In general, the CORF must assess and challenge each business line s contributions to risk 
measurement, management, and reporting processes. 

Larger, more complex banking institutions will typically have a more formalized approach 
to the implementation of the lines of defense against operational risks, including the 
implementation of the CORF. For example, a large bank may have a fully staffed group 
skilled specifically in operational risk management, while a smaller bank may simply fold 
operational risk management into the broader risk management function of the bank. 

Principles of Operational Risk Management 


LO 37.2: Summarize the fundamental principles of operational risk management 
as suggested by the Basel committee. 


Operational risks must be proactively managed by a banks board of directors and senior 
managers as well as its business line managers and employees. The 11 fundamental 
principles of operational risk management suggested by the Basel Committee are: 

1. The maintenance of a strong risk management culture led by the banks board of 
directors and senior managers. This means that both individual and corporate values 
and attitudes should support the banks commitment to managing operational risks. 

2. The operational risk framework (referred to as the “Framework” in this topic) must 
be developed and fully integrated into the overall risk management processes of the 
bank. 

3. The board should approve and periodically review the Framework. The board should 
also oversee senior management to ensure that appropriate risk management decisions 
are implemented at all levels of the firm. 
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4. The board must identify the types and levels of operational risks the bank is willing to 
assume as well as approve risk appetite and risk tolerance statements. 

5. Consistent with the banks risk appetite and risk tolerance, senior management must 
develop a well-defined governance structure within the bank. The structure must 
be implemented and maintained throughout the banks various lines of business, its 
processes, and its systems. The board of directors should approve this governance 
structure. 

6. Senior management must understand the risks, and the incentives related to those 
risks, inherent in the bank’s business lines and processes. These operational risks must 
be identified and assessed by managers. 

7. New lines of business, products, processes, and systems should require an approval 
process that assesses the potential operational risks. Senior management must make 
certain this approval process is in place. 

8. A process for monitoring operational risks and material exposures to losses should be 
put in place by senior management and supported by senior management, the board of 
directors and business line employees. 

9. Banks must put strong internal controls, risk mitigation, and risk transfer strategies in 
place to manage operational risks. 

10. Banks must have plans in place to survive in the event of a major business disruption. 

Business operations must be resilient. 

11. Banks should make disclosures that are clear enough that outside stakeholders can 
assess the bank’s approach to operational risk management. 

The Role of the Board and Senior Management 


LO 37.3: Explain guidelines for strong governance of operational risk, and evaluate 
the role of the board of directors and senior management in implementing an 
effective operational risk framework. 


The attitudes and expectations of the board of directors and senior management are critical 
to an effective operational risk management program. 

With respect to Principle 1, the board of directors and/or senior management should: 

• Provide a sound foundation for a strong risk management culture within the bank. 

A strong risk management culture will generally mitigate the likelihood of damaging 
operational risk events. 
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• Establish a code of conduct (or ethics policy) for all employees that outlines 
expectations for ethical behavior. The board of directors should support senior managers 
in producing a code of conduct. Risk management activities should reinforce the code 
of conduct. The code should be reflected in training and compensation as well as risk 
management. There should be a balance between risks and rewards. Compensation 
should be aligned not just with performance, but also with the banks risk appetite, 
strategic direction, financial goals, and overall soundness. 

• Provide risk training throughout all levels of the bank. Senior management should 
ensure training reflects the responsibilities of the person being trained. 

With respect to Principle 2, the board of directors and/or senior management should: 

• Thoroughly understand both the nature and complexity of the risks inherent in the 
products, lines of business, processes, and systems in the bank. Operational risks are 
inherent in all aspects of the bank. 

• Ensure that the Framework is fully integrated in the banks overall risk management 
plan across all levels of the firm (i.e., business lines, new business lines, products, 
processes, and/or systems). Risk assessment should be a part of the business strategy of 
the bank. 

With respect to Principle 3, the board of directors and/or senior management should: 

• Establish a culture and processes that help bank managers and employees understand 
and manage operational risks. The board must develop comprehensive and dynamic 
oversight and control mechanisms that are integrated into risk management processes 
across the bank. 

• Regularly review the Framework. 

• Provide senior management with guidance regarding operational risk management and 
approve policies developed by senior management aimed at managing operational risk. 

• Ensure that the Framework is subject to independent review. 

• Ensure that management is following best practices in the field with respect to 
operational risk identification and management. 

• Establish clear lines of management responsibility and establish strong internal 
controls. 

With respect to Principle 4, the board of directors and/or senior management should: 

• Consider all relevant risks when approving the banks risk appetite and tolerance 
statements. The board must also consider the banks strategic direction. The board 
should approve risk limits and thresholds. 

• Periodically review the risk appetite and tolerance statements. The review should 
specifically focus on: 

♦ Changes in the market and external environment. 

♦ Changes in business or activity volume. 

♦ Effectiveness of risk management strategies. 

♦ The quality of the control environment. 

♦ The nature of, frequency of, and volume of breaches to risk limits. 

With respect to Principle 5, the board of directors and/or senior management should: 

• Establish systems to report and track operational risks and maintain an effective 
mechanism for resolving problems. Banks should demonstrate the effective use of the 
three lines of defense to manage operational risk, as outlined by the Basel Committee. 
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• Translate the Framework approved by the board into specific policies and procedures 
used to manage risk. Senior managers should clearly assign areas of responsibility and 
should ensure a proper management oversight system to monitor risks inherent in the 
business unit. 

• Ensure that operational risk managers communicate clearly with personnel responsible 
for market, credit, liquidity, interest rate, and other risks and with those procuring 
outside services, such as insurance or outsourcing. 

• Ensure that CORF managers should have sufficient stature in the bank, commensurate 
with market, credit, liquidity, interest rate, and other risk managers. 

• Ensure that the staff is well trained in operational risk management. Risk managers 
should have independent authority relative to the operations they oversee. 

• Develop a governance structure of the bank that is commensurate with the size and 
complexity of the firm. Regarding the governance structure, the bank should consider: 

♦ Committee structure', for large, complex banks, a board-created firm level risk 
committee should oversee all risks. The management-level operational risk 
committee would report to the enterprise level risk committee. 

♦ Committee composition', committee members should have business experience, 
financial experience, and independent risk management experience. Independent, 
non-executive board members may also be included. 

♦ Committee operation', committees should meet frequently enough to be productive 
and effective. The committee should keep complete records of committee meetings. 

With respect to Principle 6, the board of directors and/or senior management should: 

• Consider both internal and external factors to identify and assess operational risk. 

Examples of tools that may be used to identify and assess risk are described in LO 37.4. 

With respect to Principle 7, the board of directors and/or senior management should: 

• Maintain a rigorous approval process for new products and processes. The bank 
should make sure that risk management operations are in place from the inception 
of new activities because operational risks typically increase when a bank engages in 
new activities, new product lines, enters unfamiliar markets, implements new business 
processes, puts into operation new technology, and/or engages in activities that are 
geographically distant from the main office. 

• Thoroughly review new activities and product lines, reviewing inherent risks, potential 
changes in the banks risk appetite or risk limits, necessary controls required to mitigate 
risks, residual risks, and the procedures used to monitor and manage operational risks. 

With respect to Principle 8, the board of directors and/or senior management should: 

• Continuously improve the operational risk reporting. Reports should be manageable in 
scope but comprehensive and accurate in nature. 

• Ensure that operational risk reports are timely. Banks should have sufficient resources to 
produce reports during both stressed and normal market conditions. Reports should be 
provided to the board and senior management. 

• Ensure that operational risk reports include: 

♦ Breaches of the banks risk appetite and tolerance statement. 

♦ Breaches of the banks thresholds and risk limits. 

♦ Details of recent operational risk events and/or losses. 

♦ External events that may impact the banks operational risk capital. 

♦ Both internal and external factors that may affect operational risk. 


©2018 Kaplan, Inc. 


Page 5 



Topic 37 

Cross Reference to GARP Assigned Reading - Basel Committee on Banking Supervision 

With respect to Principle 9, the board of directors and/or senior management should have 
a sound internal control system as described in LO 37.5 (an effective control environment) 
and LO 37.6 (managing technology and outsourcing risks). 

Banks may need to transfer risk (e.g., via insurance contracts) if it cannot be adequately 
managed within the bank. However, sound risk management controls must be in place and 
thus risk transfer should be seen as a complement to, rather than a replacement for, risk 
management controls. New risks, such as counterparty risks, may be introduced when the 
bank transfers risk. These additional risks must also be identified and managed. 

With respect to Principle 10, the board of directors and/or senior management should: 

• Establish continuity plans to handle unforeseen disruptive events (e.g., disruptions in 
technology, damaged facilities, pandemic illnesses that affect personnel, and so on). Plans 
should include impact analysis and plans for recovery. Continuity plans should identify 
key facilities, people, and processes necessary for the business to operate. The plan must 
also identify external dependencies such as utilities, vendors, and other third party 
providers. 

• Periodically review continuity plans. Personnel must be trained to handle emergencies 
and, where possible, the bank should perform disaster recovery and continuity tests. 

With respect to Principle 11, the board of directors and/or senior management should: 

• Write public disclosures such that stakeholders can assess the banks operational risk 
management strategies. 

• Write public disclosures that are consistent with risk management procedures. The 
disclosure policy should be established by the board of directors and senior management 
and approved by the board of directors. The bank should also be able to verify 
disclosures. 

Operational Risk Management Framework 

The operational risk management framework (i.e., the Framework) must define, describe, 
and classify operational risk and operational loss exposure. The Framework helps the board 
and managers understand the nature and complexities of operational risks inherent in the 
banks products and services. The components of the Framework should be fully integrated 
into the banks overall risk management plan. The Framework must be documented in the 
board of directors approved policies. 

Framework documentation, which is overseen by the board of directors and senior 
management, should: 

• Describe reporting lines and accountabilities within the governance structure used to 
manage operational risks. 

• Describe risk assessment tools. 

• Describe the banks risk appetite and tolerance. 

• Describe risk limits. 

• Describe the approved risk mitigation strategies (and instruments). 

• With respect to inherent and residual risk exposures, describe the banks methods for 
establishing risk limits and monitoring risk limits. 

• Establish risk reporting processes and management information systems. 

• Establish a common language or taxonomy of operational risk terms to create 
consistency of risk identification and management. 
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• Establish a process for independent review of operational risk. 

• Require review of established policies and procedures. 

Tools for Identifying and Assessing Operational Risk 


LO 37.4: Describe tools and processes that can be used to identify and assess 
operational risk. 


Tools that may be used to identify and assess operational risk include: 

• Business process mappings, which do exactly that, map the banks business processes. 
Maps can reveal risks, interdependencies among risks, and weaknesses in risk 
management systems. 

• Risk and performance indicators are measures that help managers understand the banks 
risk exposure. There are Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs). 
KRIs are measures of drivers of risk and exposures to risk. KPIs provide insight into 
operational processes and weaknesses. Escalation triggers are often paired with KRIs and 
KPIs to warn when risk is approaching or exceeding risk thresholds. 

• Scenario analysis is a subjective process where business line managers and risk managers 
identify potential risk events and then assess potential outcomes of those risks. 

• Measurement involves the use of outputs of risk assessment tools as inputs for 
operational risk exposure models. The bank can then use the models to allocate 
economic capital to various business units based on return and risk. 

• Audit findings identify weaknesses but may also provide insights into inherent 
operational risks. 

• Analysis of internal operational loss data. Analysis can provide insight into the causes of 
large losses. Data may also reveal if problems are isolated or systemic. 

• Analysis of external operational loss data including gross loss amounts, dates, amount of 
recoveries and losses at other firms. 

• Risk assessments, or risk self assessments (RSAs), address potential threats. Assessments 
consider the banks processes and possible defenses relative to the firms threats and 
vulnerabilities. Risk Control Self Assessments (RCSA) evaluate risks before risk controls are 
considered (i.e., inherent risks). Scorecards translate RCSA output into metrics that help 
the bank better understand the control environment. 

• Comparative analysis combines all described risk analysis tools into a comprehensive 
picture of the banks operational risk profile. For example, the bank might combine audit 
findings with internal operational loss data to better understand the weaknesses of the 
operational risk framework. 

Features of an Effective Control Environment 


LO 37.5: Describe features of an effective control environment and identify specific 
controls that should be in place to address operational risk. 

An effective control environment must include the following five components: 

1. A control environment. 

2. Risk assessment. 
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3. Control activities. 

4. Information and communication. 

5. Monitoring activities. 

Senior managers should conduct top-level reviews of progress toward stated risk objectives, 
verify compliance of standards and controls, review instances of non-compliance, evaluate 
the approval system to ensure accountability, and track reports of exceptions to risk limits 
and management overrides and deviations from risk policies and controls. Managers should 
also ensure that duties are segregated and conflicts of interest are identified and minimized. 

Specific controls that should be in place in the organization to address operational risk 
include: 

• Clearly established lines of authority and approval processes for everything from new 
products to risk limits. 

• Careful monitoring of risk thresholds and limits. 

• Safeguards to limit access to and protect bank assets and records. 

• An appropriately sized staff to manage risks. 

• An appropriately trained staff to manage risks. 

• A system to monitor returns and identify returns that are out of line with expectations 
(e.g., a product that is generating high returns but is supposed to be low risk may 
indicate that the performance is a result of a breach of internal controls). 

• Confirmation and reconciliation of bank transactions and accounts. 

• A vacation policy that requires officers and employees to be absent for a period not less 
than two consecutive weeks. 

Managing Technology Risk and Outsourcing Risk 


LO 37.6: Explain the Basel Committee s suggestions for managing technology risk 
and outsourcing risk. 


Technology can be used to mitigate operational risks. For example, automated procedures 
are generally less prone to error than manual procedures. However, technology introduces 
its own risks. The Basel Committee recommends an integrated approach to identifying, 
measuring, monitoring, and managing technology risks. 

Technology risk management tools are similar to those suggested for operational risk 
management and include: 

• Governance and oversight controls. 

• Policies and procedures in place to identify and assess technology risks. 

• Written risk appetite and tolerance statements. 

• Implement a risk control environment. 

• Establish risk transfer strategies to mitigate technology risks. 

• Monitor technology risks and violations of thresholds and risk limits. 

• Create a sound technology infrastructure (i.e., the hardware and software components, 
data and operating environments). 
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Outsourcing involves the use of third parties to perform activities or functions for the 
firm. Outsourcing may reduce costs, provide expertise, expand bank offerings, and/or 
improve bank services. The board of directors and senior management must understand the 
operational risks that are introduced as a result of outsourcing. Outsourcing policies should 
include: 

• Processes and procedures for determining which activities can be outsourced and how 
the activities will be outsourced. 

• Processes for selecting service providers (e.g., due diligence). 

• Structuring the outsourcing agreement to describe termination rights, ownership of data, 
and confidentiality requirements. 

• Monitor risks of the arrangement including the financial health of the service provider. 

• Implement a risk control environment and assess the control environment at the service 
provider. 

• Develop contingency plans. 

• Clearly define responsibilities of the bank and the service provider. 
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Key Concepts 


L0 37.1 

The Basel Committee on Banking Supervision defines operational risk as, “the risk of loss 
resulting from inadequate or failed internal processes, people, and systems or from external 
events.” 

The Basel Committee recognizes three common lines of defense used to control operational 
risks. These lines of defense are: (1) business line management, (2) independent operational 
risk management function, and (3) independent reviews of operational risks and risk 
management. 


LO 37.2 

The 11 fundamental principles of operational risk management suggested by the Basel 

Committee are: 

1. The maintenance of a strong risk management culture led by the banks board of 
directors and senior management. 

2. The operational risk framework (i.e., the “Framework”) must be developed and fully 
integrated in the overall risk management processes of the bank. 

3. The board should approve and periodically review the Framework. The board should 
also oversee senior management to ensure that appropriate risk management decisions 
are implemented at all levels of the firm. 

4. The board must identify the types and levels of operational risks the bank is willing to 
assume as well as approve risk appetite and risk tolerance statements. 

5. Consistent with the banks risk appetite and risk tolerance, senior management must 
develop a well-defined governance structure within the bank. 

6. Operational risks must be identified and assessed by managers. Senior management 
must understand the risks, and the incentives related to those risks, inherent in the 
banks business lines and processes. 

7. New lines of business, products, processes, and systems should require an approval 
process that assesses the potential operational risks. 

8. A process for monitoring operational risks and material exposures to losses should be 
put in place by senior management and supported by senior management, the board of 
directors, and business line employees. 

9. Banks must put strong internal controls and risk mitigation and risk transfer strategies 
in place to manage operational risks. 
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10. Banks must have plans in place to survive in the event of a major business disruption. 

Business operations must be resilient. 

11. Banks should make disclosures that are clear enough that outside stakeholders can assess 
the banks approach to operational risk management. 


LO 37.3 

The board of directors and senior management must be engaged with operational risk 
assessment related to all 11 of the fundamental principles of operational risk management. 
The operational risk management framework must define, describe, and classify operational 
risk and operational loss exposure. The Framework must be documented in the board of 
directors approved policies. 


LO 37.4 

There are several tools that may be used to identify and assess operational risk. The tools 
include business process mappings, risk and performance indicators, scenario analysis, 
using risk assessment outputs as inputs for operational risk exposure models, audit findings, 
analyzing internal and external operational loss data, risk assessments, and comparative 
analysis. 


LO 37.5 

An effective control environment should include the following five components: 

(1) a control environment, (2) risk assessment, (3) control activities, (4) information 
and communication, and (5) monitoring activities. 


LO 37.6 

Technology can be used to mitigate operational risks but it introduces its own risks. 

The Basel Committee recommends an integrated approach to identifying, measuring, 
monitoring, and managing technology risks. Technology risk management tools are similar 
to those suggested for operational risk management. 

Outsourcing involves the use of third parties to perform activities or functions for the 
firm. Outsourcing may reduce costs, provide expertise, expand bank offerings, and/or 
improve bank services. The board of directors and senior management must understand the 
operational risks that are introduced as a result of outsourcing. 
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Concept Checkers 


1. Griffin Riehl is a risk manager at Bluegrass Bank and Trust, a small, independent 
commercial bank in Kentucky. Riehl has recently read the Basel Committee on 
Banking Supervisions recommendations for sound operational risk management and 
would like to put several controls in place. He would like to start with the three lines 
of defense suggested by the committee. Which of the following is not one of the 
three common “lines of defense” suggested by the Basel Committee for operational 
risk governance? 

A. Business line management. 

B. Board of directors and senior management risk training programs. 

C. Creating an independent operational risk management function in the bank. 

D. Conducting independent reviews of operational risks and risk management 
operations. 

2. Garrett Bridgewater, a trader at a large commercial bank, has continued to increase 
his bonus each year by producing more and more profit for the bank. In order to 
increase profits, Bridgewater has been forced to increase the riskiness of his positions, 
despite the written risk appetite and tolerance statements provided to all employees 
of the bank. The bank seems happy with his performance so Bridgewater takes 

that as a sign of approval of his methods for improving profitability. Which of the 
following pairs of the 11 fundamental principles of risk management has the bank 
most clearly violated in this situation? 

A. Principle 1 (a strong risk management culture) and Principle 11 (the bank 
should make clear disclosures of operational risks to stakeholders). 

B. Principle 2 (develop an integrated approach to operational risk management) 
and Principle 7 (establish a rigorous approval process for new lines of business). 

C. Principle 3 (approve and review the operational risk framework) and Principle 4 
(develop risk appetite and tolerance statements). 

D. Principle 5 (develop a well-defined governance structure) and Principle 6 
(understand the risk and incentives related to risk inherent in the banks business 
lines and processes). 

3. Gary Hampton is providing descriptions of the operational risk management 
assessment tools, reporting lines, and accountabilities to the board of directors. 
Hampton is most likely working on: 

A. Framework documentation. 

B. A corporate operational risk function (CORF) handbook of operations. 

C. An outline of the fundamental principles of operational risk management. 

D. An open group operational framework diagram. 
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4. George Mathis works in risk analysis and management at a large commercial bank. 

He uses several tools to identify and assess operational risk. He has asked several 
business line managers to identify some risk events that would disrupt business. Each 
manager has also provided their thoughts on what would happen given worst case 
operational failures. The risk assessment tool Mathis is most likely using in this case 
is(are): 

A. risk indicators. 

B. comparative analysis. 

C. scenario analysis. 

D. business process mappings. 

5. A risk management officer at a small commercial bank is trying to institute strong 
operational risk controls, despite little support from the board of directors. The 
manager is considering several elements as potentially critical components of a 
strong control environment. Which of the following is not a required component 
of an effective risk control environment as suggested by the Basel Committee on 
Banking Supervision? 

A. Information and communication. 

B. Monitoring activities. 

C. A functionally independent corporate operational risk function. 

D. Risk assessment. 
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Concept Checker Answers 


1. B The three common “lines of defense” suggested by the Basel Committee on Banking 

Supervision and employed by firms to control operational risks are: (1) business 
line management, (2) an independent operational risk management function, and 

(3) independent reviews of operational risks and risk management. 

2. D Based on the choices provided, the best match for the scenario is a violation of Principles 5 

and 6. It is clear that the bank has not considered the incentives that are related to risk taking 
in the bank. Bridgewater has been given the risk appetite and tolerance statements but senior 
managers keep rewarding Bridgewater for high returns and seem to be ignoring the fact that 
they are the result of higher risks. Thus, there are incentives linked to increasing risk. The 
governance structure may or may not be well defined, but regardless, is not being adhered to. 

3. A The operational risk management framework (i.e., the Framework) must define, describe, 

and classify operational risk and operational loss exposure. Hampton is likely working on 
Framework documentation. Framework documentation is overseen by the board of directors 
and senior management. 

4. C Mathis is asking for managers to identify potential risk events, which he will use to assess 

potential outcomes of these risks. This is an example of scenario analysis. Scenario analysis 
is a subjective process where business line managers and risk managers identify potential risk 
events and then assess potential outcomes of those risks. 

5. C A functionally independent corporate operational risk function is desirable in a bank but is 

not necessary for an effective control environment. This is especially true for a small bank, 
which might roll all risk management activities into one risk management group (i.e., not 
segregated by type of risk). An effective control environment should include the following 
five components: (1) a control environment, (2) risk assessment, (3) control activities, 

(4) information and communication, and (5) monitoring activities. 
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The following is a review of the Operational and Integrated Risk Management principles designed to address 
the learning objectives set forth by GARP®. This topic is also covered in: 


Enterprise Risk Management: 
Theory and Practice 


Topic 38 


Exam Focus 

Enterprise risk management (ERM) is the process of managing all of a corporations risks 
within an integrated framework. This topic describes how ERM can be implemented in a 
way that enables a company to manage its total risk-return tradeoff in order to better carry 
out its strategic plan, gain competitive advantage, and create shareholder value. Key issues 
include why it may be optimal to hedge diversifiable risk and how to differentiate between 
core risks the firm should retain and noncore risks the firm should layoff Also discussed is 
the determination of the optimal amount of corporate risk and the importance of ensuring 
that managers at all levels take proper account of the risk-return tradeoff For the exam, 
understand the framework for developing and implementing ERM. 


Creating Value With ERM 


LO 38.1: Define enterprise risk management (ERM) and explain how 
implementing ERM practices and policies can create shareholder value, both at the 
macro and the micro level. 


A business can manage its risks separately, one at a time, or all together in a cohesive 
framework. Enterprise risk management (ERM) is the process of managing all of a 
corporations risks within an integrated framework. 

The benefit of ERM is that a comprehensive program for managing risk allows the business 
to achieve its ideal balance of risk and return. 

Macro Level 

At the macro level, ERM allows management to optimize the firms risk/return tradeoff 
This optimization assures access to the capital needed to execute the firms strategic plan. 

The perfect markets view of finance implies that a company’s cost of capital is unrelated to 
its diversifiable risk. Rather, the cost of capital is determined by the firm’s systematic risk 
(also referred to as nondiversifiable, market, or beta risk). According to this view, efforts to 
hedge diversifiable risk provide no benefit to shareholders, who can eliminate this risk by 
diversifying their portfolios. 

However, reducing diversifiable risk can be beneficial when markets are imperfect. Suppose 
a firm experiences a large and unexpected drop in its operating cash flow and does not have 
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funds sufficient to fund valuable investment opportunities. In perfect markets, the firm 
would be able to raise funds on fair terms to fund all of its value-creating projects. When 
markets are not perfect (i.e., investors’ information about project values is incomplete), 
the firm may not be able to raise the needed funds on fair terms. This can lead to the 
“underinvestment problem,” where the company passes up valuable strategic investments 
rather than raise equity on onerous terms. The inability to fund strategic investments on 
a timely basis can result in a permanent reduction in shareholder value, even if the cash 
shortfall is temporary. By hedging diversifiable risks, the company reduces the likelihood 
of facing the underinvestment problem. Thus, the primary function of corporate risk 
management is to protect the company’s strategic plan by ensuring timely investment. 

The ability to carry out the strategic plan in a timely manner confers an advantage over 
competitors who are unable to do so. 

Micro Level 

In order for ERM to achieve the objective of optimizing the risk/return tradeoff, each 
project must be evaluated not only for the inherent risk of the project but also for the effect 
on the overall risk of the firm. Thus, ERM requires that managers throughout the firm be 
aware of the ERM program. This decentralization of evaluating the risk/return tradeoff has 
two components: 

• Any managers evaluating new projects must consider the risks of the project in the 
context of how the project will affect the firm’s total risk. 

• Business units must be evaluated on how each unit contributes to the total risk of the 
firm. This gives the individual managers an incentive to monitor the effect of individual 
projects on overall firm risk. 

There are three reasons why decentralizing the risk-return tradeoff in a company is 
important: 

1. Transformation of the risk management culture: A consistent, systematic assessment of 
risks by all business units ensures that managers consider the impact of all important 
risks. 

2. Every risk is owned: Because performance evaluations are based on risk, managers have 
an incentive to consider important risks in their decision making. 

3. Risk assessment by those closest to the risk: Managers in the individual business units have 
the knowledge and expertise needed to assess and manage the risks of the business unit. 
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LO 38.2: Explain how a company can determine its optimal amount of risk 
through the use of credit rating targets. 

LO 38.3: Describe the development and implementation of an ERM system, as 
well as challenges to the implementation of an ERM system. 


In developing an ERM, management should follow this framework: 

• Determine the firm* *s acceptable level of risk. The critical component of this determination 
is selecting the probability of financial distress that maximizes the value of the firm. 
Financial distress in this context means any time the firm must forego projects with 
positive net present values, due to inadequate resources. The likelihood of financial 
distress could be minimized by investing all funds into U.S. Treasury securities, but 
this should not be the firms objective. The objective should be maximizing firm value 
by selecting an appropriate probability of distress. For many firms, the proxy used 

for measuring the probability of distress is the firms credit rating assigned by external 
agencies. Thus, the firm may determine that the objective under ERM is to avoid a 
minimum credit rating below BBB. If the firm is currently rated AA, for example, the 
likelihood of falling below BBB can be estimated by average data supplied by the rating 
agency. 

• Based on the firm*s target debt rating, estimate the capital (i.e., buffer) required to support 
the current level of risk in the firm's operations. In other words, how much capital does the 
firm need to have (on hand or available externally) to ensure that it can avoid financial 
distress. A company with liquid assets sufficient to fund all of its positive NPV projects 
would not be exposed to the underinvestment problem when it encountered cash 

flow deficits. Thus, risk management can be viewed as a substitute for investing equity 
capital in liquid assets. Keeping a large amount of equity in the form of liquid assets 
is costly. Instead of maintaining a large liquid asset buffer, a company can institute a 
risk management program to ensure (at some level of statistical significance) that its 
operating cash flow will not fall below the level needed to fund valuable projects. That 
is, the firm can take actions to limit the probability of financial distress to a level that 
maximizes firm value. The goal of ERM is to optimize (not eliminate) total risk by 
trading off the expected returns from taking risks with the expected costs of financial 
distress. 

• Determine the ideal mix of capital and risk that will achieve the appropriate debt rating. At 
this level of capital, the firm will be indifferent between increasing capital and decreasing 
risk. 

• Decentralize the risk/capital tradeoff by fiving individual managers the information and the 
incentive they need to make decisions appropriate to maintain the risk!capital tradeoff. 

The implementation steps of ERM are as follows: 

Step 1: Identify the risks of the firm. For many banks, risks are classified as falling into one of 
three categories: market, credit, or operational. Other financial institutions broaden 
the list to include asset, liability, liquidity, and strategic risks. Identification of risks 
should be performed both top-down (by senior management) and bottom-up (by 
individual managers of business units or other functional areas). 
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Step 2: Develop a consistent method to evaluate the firm's exposure to the risks identified above. 
If the methodology is not consistent, the ERM system will fail because capital will 
be mis-allocated across business units. 

Implementation of an ERM system is challenging, and it is important that the entire 
organization supports the system. Thus, it is critical for all levels of the organization to 
understand how the system is designed and how it can create value. Monitoring the ERM 
system may be neglected due to its time-consuming nature. However, the inability to 
identify relevant risks on a regular basis could lead to corporate failures. 


Economic Vatue vs. Accounting Value 

Credit ratings are typically based on accounting data, combined with some level of 
subjective assessment by analysts. Economic value, as determined by management, may very 
well be a more accurate reflection of the true value of the firm. 

In determining whether accounting value or economic value is more relevant, the firm must 
consider its objective. If the objective is to manage the probability of default, the question 
of how default is determined becomes important. If default is determined by failure to meet 
certain accounting measures (e.g., debt ratio, interest coverage), then accounting measures 
will be a critical component of meeting the objectives. 

If the objective is to manage the present value of future cash flows, then economic measures 
may be more appropriate than accounting measurements that do not accurately capture 
economic reality. Management must consider that managing economic value may lead to 
more volatile accounting earnings, which may ultimately affect economic value as well. 


Risk Aggregation 


LO 38.4: Describe the role of and issues with correlation in risk aggregation, and 
describe typical properties of a firms market risk, credit risk, and operational risk 
distributions. 


Firms that use value at risk (VaR) to assess potential loss amounts will ultimately have three 
different VaR measures to manage. Market risk, credit risk, and operational risk will each 
produce their own VaR measures. The trick to accurately measuring and managing firm¬ 
wide risk, and in turn firm-wide VaR, is to understand how these VaR measures interact. 
Market risks will typically follow a normal distribution; however, the distributions for credit 
risks and operational risks are usually asymmetric in shape, due to the fat-tail nature of these 
risks. 

Due to diversification effects of aggregating market, credit, and operational risk, firm-wide 
VaR will be less than the sum of the VaRs from each risk category. This suggests that the 
correlation among risks is some value less than one. It can be difficult to determine this 
correlation amount, so firms typically use average correlation values within their respective 
industry. However, firms should recognize that correlations can be influenced by firm- 
specific actions as well as external events such as a financial crisis. 
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LO 38.5: Distinguish between regulatory and economic capital, and explain the 
use of economic capital in the corporate decision making process. 


Regulatory capital requirements may differ significantly from the capital required to achieve 
or maintain a given credit rating (economic capital). If regulatory requirements are less than 
economic capital requirements, then the firm will meet the regulatory requirements as part 
of its ERM objectives, and there will be no effect on the firms activities. 

However, if regulatory capital requirements are greater than economic capital requirements, 
then the firm will have excess capital on hand. If competitors are subject to the same 
requirements, this excess capital will amount to a regulatory tax. If competing firms are not 
subject to the excess capital requirement, they will have a competitive advantage. 

Because regulatory capital requirements are typically based on accounting capital, rather 
than economic capital, a firm with economic values in excess of accounting values may be 
penalized, and may have to maintain higher amounts in liquid assets to cover the shortfall. 

The economic capital of the firm must be put to productive use. If a firm accumulates 
excess economic capital that is not employed productively, investors will reduce the value of 
the firm. This reduction will be consistent with the failure of existing management to earn 
the cost of capital on the excess amount. 

As a firm takes on new projects, the probability of financial distress increases. One way to 
offset this increased risk is to raise enough additional capital to bring the risk of financial 
distress back to the level that existed prior to the new project. 

For example, assume that a firm has a value at risk (VaR) measure of $I billion. As a result 
of a new expansion project, assume the VaR figure increases to $1.1 billion. In order to 
offset the risk of the new project, the firm would need to do the following: 

1. Raise additional capital of $100 million. 

2. Invest this additional capital without increasing the overall risk of the firm. 

If the cost of the additional capital is 6%, and the new project is expected to last one 
year, then the new project would need to generate an additional $6 million to maintain 
the economic capital of the firm. Looked at another way, the expected benefit of the new 
project should be reduced by $6 million to compensate for the incremental risk to the firm. 

These decisions regarding how the risk of new projects will affect the total risk of the firm 
are further complicated by the correlations of the expected returns of the projects. If two 
new projects are less than perfectly correlated, the incremental increase in total risk will be 
less. One way to account for any possible diversification benefits is to reduce the cost of 
capital of projects that are expected to have lower correlations with existing operations. 
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Risks to Retain and Risks to Layoff 

Many risks can be hedged inexpensively with derivatives contracts. Examples include 
exposures to changes in exchange rates, interest rates, and commodities prices. Rather than 
face the risk that unexpected cash shortfalls due to these exposures might negatively affect 
the ability of the firm to carry out its strategic plan, the firm should hedge these exposures. 

Other risks cannot be inexpensively hedged. These are risks where the firms management 
either has an informational advantage over outsiders or the ability to manage the outcome 
of the risk-taking activity. A counterparty to a transaction that hedges such risks would 
require very high compensation to be willing to take on the transferred risks. The firm s 
business risks fall into this category. 

The guiding principle in deciding whether to retain or layoff risks is the comparative 
advantage in risk bearing. A company has a comparative advantage in bearing its strategic 
and business risks, because it knows more about these risks than outsiders do. Because of 
this informational advantage, the firm cannot transfer these risks cost effectively. Moreover, 
the firm is in the business of managing these “core” risks. On the other hand, the firm has 
no comparative advantage in forecasting market variables such as exchange rates, interest 
rates, or commodities prices. These “noncore” risks can be laid off By reducing noncore 
exposures, the firm reduces the likelihood of disruptions to its ability to fund strategic 
investments and increases its ability to take on business risks. 
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Key Concepts 


L0 38.1 

Enterprise risk management (ERM) is the process of managing all a corporations risks 
within an integrated framework. 

The macro benefit of ERM is that hedging corporate diversifiable risk improves 
managements ability to invest in value-creating projects in a timely manner and improves 
the firms ability to carry out the strategic plan. 

The micro benefit of ERM requires decentralizing risk management to ensure that each 
projects total risk is adequately assessed by project planners during the initial evaluation 
of the project. The two main components of decentralizing the risk-return tradeoff 
are consideration of the marginal impact of each project on the firms total risk and a 
performance evaluation system that considers unit contributions to total risk. 


LO 38.2 

The goal of risk management is to optimize (not eliminate) total risk by trading off the 
expected returns from taking risks with the expected costs of financial distress. Financial 
distress in this case is defined as circumstances where the firm is forced to forego positive 
NPV projects. 


LO 38.3 

The conceptual framework of ERM is a four-step process: 

• Determine the firms risk appetite. 

• Estimate the amount of capital needed to support the desired level of risk. 

• Determine the optimal combination of capital and risk that achieves the target credit 
rating. 

• Decentralize the management of risk. 


LO 38.4 

Due to diversification effects of aggregating market, credit, and operational risk, firm-wide 
VaR will be less than the sum of the VaRs from each risk category. This suggests that the 
correlation among risks is some value less than one. 
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LO 38.5 

Regulatory capital requirements may differ significantly from the capital required to achieve 
or maintain a given credit rating (economic capital). 

Because regulatory capital requirements are typically based on accounting capital, rather 
than economic capital, a firm with economic values in excess of accounting values may be 
penalized, and may have to maintain higher amounts in liquid assets to cover the shortfall. 

The economic capital of the firm must be put to productive use. If a firm accumulates 
excess economic capital that is not employed productively, investors will reduce the value of 
the firm. 
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Concept Checkers 


1. Reducing diversifiable risk creates value: 

A. only when markets are perfect. 

B. because it is costly for shareholders to eliminate diversifiable risk through their 
own actions. 

C. because reducing diversifiable risk mitigates the underinvestment problem that 
can occur when investors have imperfect information about the firms projects. 

D. only when it results in a permanent reduction in cash flow. 

2. Effective enterprise risk management includes all of the following except: 

A. centralized evaluation of every projects risk. 

B. a project is only accepted if its return is adequate after considering the cost of 
the projects contribution to total firm risk. 

C. the projects planners perform the initial evaluation of project risk. 

D. periodic evaluations of the performance of business units consider each units 
contribution to total risk. 

3. The goal of enterprise risk management (ERM) can best be described as maximizing 
firm value by: 

A. eliminating the total risk of the firm. 

B. minimizing the total risk of the firm. 

C. optimizing the total risk of the firm. 

D. eliminating the probability of financial distress. 

4. In determining the relative importance of economic value compared to accounting 
performance in its enterprise risk management program, a firm should: 

A. rely on accounting performance because it will be more accurate. 

B. rely on economic value because it will be more accurate. 

C. base its decision on the input of project-level managers. 

D. base its decision on the objective of the ERM program. 

5. Which risk is least likely to be beneficial for a company to layoff? 

A. Currency exchange rate risk. 

B. Business risk. 

C. Commodities price risk. 

D. Interest rate risk. 
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Concept Checker Answers 


1. C when markets are not perfect (i.e., investors’ information about project values is 

incomplete), the firm may not be able to raise funds on fair terms. For a firm faced with an 
unexpected drop in operating cash flow, this can lead to the underinvestment problem, where 
the company passes up valuable strategic investments rather than raise equity on onerous 
terms. The inability to fund strategic investments can result in a permanent reduction in 
shareholder value even if the cash shortfall is temporary. Hedging diversifiable risk mitigates 
the underinvestment problem and creates value, even though shareholders can eliminate 
diversifiable risk at low cost by diversifying their portfolios. 

2. A Central to ERM is the idea that a decentralized approach to the evaluation of project risks 

focuses managers throughout the firm on the importance of properly considering the risk 
and return implications of projects. 

3. C The goal of ERM is to optimize the total risk of the firm. Eliminating total risk is not 

possible. Minimizing total risk would preclude accepting risky projects that would allow 
the firm to expand and maximize value. These risky projects will increase the probability of 
financial distress. The goal of ERM is to optimize the risk of distress relative to the potential 
returns from the risky projects. 

4. D There are certain situations where either accounting values or economic values will more 

accurately reflect the firm’s situation. The determining factor in choosing between economic 
values and accounting values is the objective of the program. For example, if the objective is 
maintaining a rating, based in large part on accounting numbers, then accounting numbers 
will assume more relative importance. 

5. B A company has a comparative advantage in bearing its strategic and business risks because 

it knows more about these risks than outsiders do. The firm is in the business of managing 
these “core” risks. The firm has no comparative advantage in forecasting market variables 
such as exchange rates, interest rates, or commodities prices. These “noncore” risks can be 
laid off. 
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The following is a review of the Operational and Integrated Risk Management principles designed to address 
the learning objectives set forth by GARP®. This topic is also covered in: 

Observations on Developments in 
Risk Appetite Frameworks and 
IT Infrastructure 


Topic 39 

Exam Focus 

This topic discusses the concept of a risk appetite framework (RAP). For the exam, 
understand the elements and benefits of an RAF, and be familiar with best practices for an 
effective RAF. Also, be able to identify metrics that can be monitored as part of an effective 
RAF. Finally, understand the elements and benefits of a robust risk data infrastructure as well 
as best practices relating to data aggregation. 


Risk Appetite Framework 


LO 39.1: Describe the concept of a risk appetite framework (RAF), identify the 
elements of an RAF, and explain the benefits to a firm of having a well-developed 


RAF. 


A risk appetite framework (RAF) is a strategic decision-making tool that represents the 
firm s core risk strategy. It sets in place a clear, future-oriented perspective of the firm s target 
risk profile in a number of different scenarios and maps out a strategy for achieving that 
risk profile. It also specifies which types of risk the firm is willing to take and under what 
conditions as well as which types of risk the firm is unwilling to take. 

An RAF should start with a risk appetite statement that is essentially a mission statement 
from a risk perspective. This statement should cover some or all of the following elements: 

• Desired business mix and balance sheet composition (i.e., capital structure—trade-off 
between debt and equity). 

• Risk preferences (i.e., how much credit or market risk to take on or hedge) 

• Acceptable trade-off between risk and reward. 

• Acceptable limits for volatility (based on standard deviation). 

• Capital thresholds (i.e., regulatory and economic capital). 

• Tolerances for post-stress losses. 

• Target credit ratings. 

• Optimum liquidity ratios. 

The benefits of a well-developed RAF are as follows: 

• It improves a firms strategic planning and tactical decision-making. 

• The inherent flexibility allows firms to adapt to market changes, especially if appropriate 
opportunities arise that require adjustments to the RAF. 
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• It assists firms in preparing for the unexpected; requires business line strategy reviews 
and maintains an open dialogue regarding the management of unexpected economic or 
market events in particular geographies or products. 

• It focuses on the future and sets expectations regarding the firms consolidated risk profile 
after performing relevant stress tests and scenario analyses. Thus, it helps the firm set up 
a plan for risk taking, loss mitigation, and use of contingency measures. 

Developing and Implementing an Effective RAF 


LO 39.2: Describe best practices for a firms Chief Risk Officer (CRO), Chief 
Executive Officer (CEO), and its board of directors in the development and 
implementation of an effective RAF. 


Chief Risk Officer (CRO) Best Practices 

Board members involved with risk issues should be able to directly contact the CRO and 
engage in frequent communication about on-going key risk issues. A best practice could 
be to create a board risk committee that is directly involved in performance review and 
compensation decisions regarding the CRO. A strong alliance between the CRO (risk 
management function) and the CFO (budgetary considerations) is key to spreading the use 
of the RAF throughout the organization. Specifically, a best practice would be for the CRO 
and CFO to report to the board at every meeting by commenting on the firms risk profile 
in comparison to the RAF. The CRO discussion could be broad and strategic in nature, and 
the CFO discussion could discuss financial impacts. 

Chief Executive Officer (CEO) Best Practices 

The CEO should strongly support the RAF and refer/use it to support challenging risk and 
strategic decisions. The willingness of the CEO to give the CRO the final word on many 
risk decisions is a best practice since it strengthens the importance of the risk management 
function. Where any instances of non-compliance with the RAF exist, a best practice would 
be for the CRO and/or the CEO to advise the board of directors on the corrective measures 
that will be undertaken. 

Board of Directors (Board) Best Practices 

The board needs to spend a considerable amount of time conveying the firms risk appetite 
statement throughout the firm to ensure it is properly implemented. In challenging 
management to operate the firm in a way that is congruent with the RAF, the board must 
focus on strategic and forward-looking issues rather than dwelling on past actions. A best 
practice would be for the board to state its expectations to management in advance so that 
management can establish appropriate strategic plans. 

When a board challenges management and requires a thorough vetting of the RAF, the end 
product is more complete and relevant. A best practice is to have the active involvement 
of the board with senior management in continually revising the RAF until everyone 
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is satisfied. Additionally, another best practice is the development of a concrete way of 
assessing when the RAF needs to be amended to reflect a changing environment. 

With regard to technical knowledge of members, there should be a sufficient balance in 
board composition to ensure all members have a reasonable and congruent understanding 
of the firms risks and to avoid situations where there are marked divisions between “experts” 
and “non-experts.” A best practice is to provide detailed technical training to board 
members on relevant concepts. Additionally, requiring cross-membership amongst the 
major committees helps ensure that those functions have members with a strong technical 
base. The training and cross-membership practices should serve as supplements to existing 
expertise. 

Boards must be proactive in stating the nature and frequency of the information they need. 

As a best practice, reporting to the board should be thorough and broad in scope and not 
overly simplified. Additionally, communication from management should include a business 
aspect and not be focused on just technical aspects. Finally, as another best practice, the 
board should be willing to push back to management if they feel the information provided 
is not sufficient for their needs. 

Reputation risk needs to have a significant amount of the board s attention. As a best 
practice, the board should set up a reputational risk committee to analyze marketplace 
changes and approve transactions on the basis of geography or product line. Attempting 
qualitative measures of reputation risk should also be done via monitoring industry 
headlines and reporting trends to the board as well as hiring external parties to conduct 
relevant surveys. 

Using RAF to Manage Business Lines 


LO 39.3: Explain the role of an RAF in managing the risk of individual business 
lines within a firm, and describe best practices for monitoring a firms risk profile 
for adherence to the RAF. 


Generally speaking, the RAF helps to ensure that each business lines strategies are 
congruent with the firms desired risk profile. The various business line managers each 
submit a medium-term business plan to senior management and/or the board to determine 
if it is consistent with the RAF. Such determinations are often made with stress tests or 
scenario analyses. Afterward, the RAF will set the risk limits allocated to each business line 
based on its desired risk profile. 

Additionally, the RAF considers the integrated nature of the business lines within the firm. 
For example, the RAF can help determine how much a given business lines medium-term 
business plans has to be amended in order to allow another business lines proposal to be 
approved. In other words, there may be some borrowing of the risk appetite allotment from 
a business line in order to take advantage of the current opportunity in another business 
line. Familiarity with the RAF by business line managers would dramatically decrease the 
number of plans that fall well outside acceptable bounds. A clear RAF assists the firm in 
preventing risk appetite drift when economic conditions change. 
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RAF Metrics for Monitoring Risk Profile 

Examples of metrics that can be monitored as part of an effective RAF are as follows: 

• Capital targets (economic capital, tangible common equity, total leverage) or capital-at- 
risk amounts. 

• Liquidity ratios, terms, and survival horizons. 

• Net interest income volatility or earnings-at-risk calculations. 

• Value at risk (VaR) limits. 

• Risk sensitivity limits. 

• Risk concentrations by internal and/or external credit ratings. 

• Expected loss ratios. 

• The firms own credit spreads. 

• Asset growth ceilings by business line or exposure type. 

• Performance of internal audit ratings. 

• Economic value added. 

• Post-stress-test targets for capital, liquidity, and earnings. 

It is important to ensure that the metrics used to monitor risk are appropriate to the users 
of the information. Therefore, the risk metrics should be divided into classes, depending on 
who is receiving the information within the firm. For example: 

• Directors should receive high-level metrics (less detail) that reflect the firms key risks. 

• CEO, CFO, CRO should receive more detailed metrics than directors. 

• Business line leaders should receive very detailed metrics, especially in relation to their 
respective business lines. 

Risk Data Infrastructure 


LO 39.4: Explain the benefits to a firm from having a robust risk data 
infrastructure, and describe key elements of an effective IT risk management policy 
at a firm. 


A benefit of a robust risk data infrastructure is the ability to aggregate timely and accurate 
data to report on credit, market, liquidity, and operational risks. This, in turn, allows 
management to make proper decisions regarding the firms strategy, risk appetite, and 
risk management during periods of constant and frequent changes. Another benefit is the 
ability to sufficiently document and convey the firms risk reporting requirements. Such 
requirements include: specific metrics, data accuracy expectations, element definitions, time 
frames, supervisory expectations, and regulatory reporting requirements. 

Key elements of an effective IT risk management policy at a firm are described as follows: 

• Clearly defined standards and internal risk reporting requirements to ensure a proper IT 
infrastructure and internal reporting. 

• Sufficient funding is provided to develop IT systems for the purpose of internal risk 
reporting; they compete equally with proposals that are revenue generating, for example. 

• Assessing IT infrastructure and capacity prior to approving new products. 

• Post-implementation reviews of IT systems performed anywhere from 6—18 months 
afterward as a check that the systems meet the risk personnels needs. 
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• The level of governance for outsourced IT activities is the same as if they were done 
in-house. There are no impediments to implementation or access to data due to 
outsourcing. 

• The existence of effective project management offices (PMOs) to ensure that timelines 
and deliverables are met. Specifically, one person is in charge of the PMO, which seems 
to result in stronger coordination and communication between project staff 

• There is a data administrator as well as a data owner, and the data owner must ensure 
a sufficiently high level of data accuracy, integrity, and availability. This helps to ensure 
that IT projects are meeting the users needs. 

• The board is able to implement relevant internal audit programs to allow for periodic 
reviews of data maintenance processes and functions. The monitoring could be 
continuous or specific to a product or business line. This would allow for the quick 
correction of any weaknesses detected by internal audit. 

Poor or Fragmented IT Infrastructure 


LO 39.5: Describe factors that can lead to poor or fragmented IT infrastructure at 
an organization. 


There are five major factors to consider with regard to poor or fragmented IT 

infrastructures. 

1. No common understanding of long-term business strategy between business lines and IT 
management. This factor often results due to internal competition for funding, thereby 
not permitting important IT infrastructure projects to be completed. 

2. Management only makes decisions based on short-term profits. As a result of this factor, 
many IT infrastructure projects are scaled back, delayed, or eliminated. 

3. Significant turnover in important IT roles within the firm. This factor has resulted in 
delays in completing IT projects. 

4. Insufficient data governance and insufficient data management plan within the firm. This 
factor results in inconsistency across business lines in how to upgrade systems; this is 
costly if the systems end up being incompatible because of the inconsistencies. 

5. Merger and acquisition activities. This factor results in multiple systems running 
simultaneously within the recently merged firm. Data aggregation across products and 
business lines becomes a significant challenge. 
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Data Aggregation Best Practices 


LO 39.6: Explain the challenges and best practices related to data aggregation at an 
organization. 


The existence of several IT systems being operated simultaneously within a firm results in 

a lack of integrated IT systems. This, in turn, requires a significant amount of manual data 

entry to allow for proper aggregation of risk data. Best practices related to data aggregation 

at an organization are explained as follows: 

• To increase efficiency and accuracy, minimize the amount of manual intervention and 
manual data manipulation (i.e., spreadsheets) by automating the risk data aggregation 
process. 

• Aggregated risk data needs to be accurate, timely, and comprehensive in order to have 
value. Therefore, there must be standards, cutoff times, and timelines regarding the 
production of internal risk reports. 

• Single platform centralized databases with single identifiers and/or consistent naming 
conventions could allow for the timely retrieval of multiple records of risk data across the 
firm. They also permit data segmentation when required to produce specific data 

(i.e., risk concentrations). 

• Create data warehouses that will take information from various subsystems and store 
them in a warehouse. The data is then filtered and reorganized so that customized reports 
can be created using specific data from the warehouse. 

• Automated reconciliation will reduce the risk of manual errors and incomplete 
information. For example, off-balance sheet data should not be omitted. 

• Periodic reconciliation of risk and financial data will ensure the accuracy and proper 
operation of the IT system. 

• For merger and acquisition transactions, ensuring that legacy IT systems are integrated 
into the chosen IT system as soon as possible. 

• When obtaining approvals for new IT purchases, involve the appropriate technical staff 
to ensure that the existing systems can process and aggregate data from these new items. 
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Topic 39 

Cross Reference to GARP Assigned Reading - Senior Supervisors Group 


Key Concepts 


L0 39.1 

A risk appetite framework (RAF) sets in place a clear, future-oriented perspective of the 
firms target risk profile in a number of different scenarios and maps out a strategy for 
achieving that risk profile. An RAF should start with a risk appetite statement that is 
essentially a mission statement from a risk perspective. Benefits of a well-developed RAF 
include assisting firms in preparing for the unexpected and greatly improving a firms 
strategic planning and tactical decision-making. 


LO 39.2 

The chief risk officer (CRO) should be easily available to the board of directors (board) and 
there should be a strong alliance between the CRO and the chief financial officer (CFO). 

The chief executive officer (CEO) should strongly support the RAF and give the CRO the 
final word on risk decisions. 

The board should: be willing to challenge management to operate the firm consistent 
with the RAF, actively work with senior management to continually revise the RAF, have 
sufficient technical and business understanding of the risks facing the firm, be proactive in 
stating the nature and frequency of the information they need, and set up a reputational 
risk committee. 


LO 39.3 

The RAF helps to ensure that each business lines strategies are congruent with the firms 
desired risk profile. It also considers the integrated nature of the business lines within the 
firm. 

Many metrics can be monitored as part of an effective RAF. Risk metrics should be divided 
into classes, depending on who is receiving the information within the firm. 


LO 39.4 

A robust data infrastructure results in management being able to make proper decisions 
regarding a firms strategy, risk appetite, and risk management. Additionally, it allows for the 
ability to sufficiently document and convey the firms risk reporting requirements. 

Key elements of an effective IT risk management policy include: clearly defined standards 
and internal risk reporting requirements, sufficient funding to develop IT systems, 
assessing IT infrastructure and capacity prior to approving new products, timely post¬ 
implementation reviews of IT systems, and sufficient governance for outsourced IT 
activities. 
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Cross Reference to GARP Assigned Reading - Senior Supervisors Group 


LO 39.5 

Poor or fragmented IT infrastructures result from a lack of common understanding of long¬ 
term business strategies between business lines and IT management, managers thinking 
only about short-term profits, significant turnover in IT roles, insufficient data governance, 
and merger and acquisition activities. 


LO 39.6 

The lack of integrated IT systems is the major challenge related to data aggregations. 

Many best practices regarding data aggregations exist including: minimizing the amount of 
manual data processes, using single platform centralized databases, creating data warehouses, 
automated and periodic data reconciliations, and timely integration of legacy IT systems. 
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Topic 39 

Cross Reference to GARP Assigned Reading - Senior Supervisors Group 


Concept Checkers 


1. Which of the following statements regarding the risk appetite framework (RAF) is 
correct? 

A. The RAF represents the firms core risk strategy. 

B. The RAF should be amended to take advantage of all profitable opportunities. 

C. The RAF focuses on which risks the firm is willing to take and under what 
conditions. 

D. The RAF begins with the risk appetite statement that contains many elements, 
including examining the composition of the income statement. 

2. As a best practice, which of the following members of senior management should 
have the final word on significant risk decisions at a firm? 

A. Chief executive officer. 

B. Chief financial officer. 

C. Chief operating officer. 

D. Chief risk officer. 

3. Which of the following statements regarding the role of a risk appetite framework 
(RAF) in managing the risk of individual business lines within a firm is correct? 

A. Individual business lines may collectively cause the firms RAF to drift when 
market conditions change. 

B. Sensitivity analysis is a robust tool to assist senior management and/or the board 
to determine consistency with the RAF. 

C. Each individual business lines risk appetite allotment according to the RAF is 
independent of the others to ensure objectivity in the process. 

D. The business line managers submit long-term business plans to senior 
management and/or the board to determine if they are consistent with the RAF. 

4. WTiich of the following statements is incorrect regarding the key elements of an 
effective IT risk management policy? 

A. Having a single person in charge of the project management office. 

B. Comparable funding for IT projects and revenue-generating projects. 

C. Post-implementation reviews of IT systems at least 24 months after 
implementation. 

D. Outsourced and in-house IT activities being subjected to the same level of 
monitoring. 

5. Which of the following items is a best practice related to data aggregation at an 
organization? 

A. Integrating legacy IT systems into the new IT system immediately. 

B. The use of one master spreadsheet to accumulate all of the data in one place. 

C. Periodic manual reconciliations to reduce the risk of errors and incomplete 
information. 

D. Allowing individual departments as much time as they require to produce 
internal reports that are accurate, timely, and comprehensive. 
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Concept Checker Answers 


1. A The RAF represents the firms core risk strategy. The RAF does not necessarily need to be 

amended every time there is a profitable opportunity; doing so would cause the RAF to lose 
its value. The RAF also focuses on which risks the firm is unwilling to take. The risk appetite 
statement would not likely include an examination of the composition of the income 
statement; it would more likely be the balance sheet (i.e., debt, equity). 

2. D The willingness of the CEO to give the CRO the final word on many risk decisions is a best 

practice, which has strengthened the importance of the risk management function. 

3. A Individual business lines may collectively cause the firms RAF to drift when market 

conditions change. Sensitivity analysis only examines one change in a variable at a time. 
More robust tools would be stress tests and scenario analyses, for example. Each business 
line s risk appetite allotment according to the RAF may be amended if another business line 
encounters an opportunity that requires more capital. The business line managers submit 
medium-term business plans to senior management and/or the board. 

4. C Post-implementation reviews should be performed 6-18 months after implementation; 

24 months or more would likely be too long. Having one person in charge of the project 
management office seems to have resulted in stronger coordination and communication 
between project staff*. 

5. A For merger and acquisition transactions, it is best that legacy IT systems are integrated 

into the chosen IT system as soon as possible. Spreadsheets are a form of manual data 
manipulation and, because they are not automated, they would not be a best practice. 
Automated reconciliations should be performed, not manual. One of the key points about 
internal risk reports is that they should be produced on a timely basis, therefore, there must 
be standards, cutoff times, and timelines regarding their production. 
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The following is a review of the Operational and Integrated Risk Management principles designed to address 
the learning objectives set forth by GARP®. This topic is also covered in: 


Information Risk and Data Quality 
Management 


Topic 40 

Exam Focus 

This topic is a qualitative examination of data quality issues. Organizations must understand 
the risks involved with data issues and be able to identify ways to protect one of their most 
valuable resources, their data. For the exam, focus on the important features of acceptable 
data as well as details surrounding data quality scorecards. 


Poor Data Quality 

The following is a list of negative impacts on a business from poor data quality. 

Financial impacts: 

• Businesses may experience lower revenues (e.g., lost sales), higher expenses 
(e.g., penalties, re-work costs), and lower cash flows as a result of inaccurate or 
incomplete data. 

Confidence-based impacts: 

• Managers may make incorrect business decisions based on faulty data. 

• Poor forecasting may result due to input errors. 

• Inaccurate internal reporting may occur with unreliable information. 

Satisfaction impacts: 

• Customers may become dissatisfied when the business processes faulty data (e.g., billing 
errors). 

• Employees may become dissatisfied when they are unable to properly perform their job 
due to flawed data. 

Productivity impacts: 

• Additional (corrective) work may be required, thereby reducing production output. 

• Delays or increases in processing time. 

Risk impacts: 

• Underestimating credit risks due to inaccurate documentation, thereby exposing a lender 
to potential losses (e.g., Basel II Accords for quantifying credit risk). 

• Underestimating investment risk, thereby exposing an investor to potential losses. 

Compliance impacts: 

• A business may no longer be in compliance with regulations (e.g., Sarbanes-Oxley) if 
financial reports are inaccurate. 
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Data Errors 


LO 40.1: Identify the most common issues that result in data errors. 


The most common data issues that increase risk for an organization are as follows: 

• Data entry errors. 

• Missing data. 

• Duplicate records. 

• Inconsistent data. 

• Nonstandard formats. 

• Complex data transformations. 

• Failed identity management processes. 

• Undocumented, incorrect, or misleading metadata (description of content and context 
of data files). 

From a financial perspective, such data errors (accidental or not) may lead to inconsistent 
reporting, incorrect product pricing, and failures in trade settlement. 

Examples of risks arising out of data errors include: 

• Fraudulent payroll overpayments to fictitious employees or those who are no longer 
employed by the firm. 

• Underbilling for services rendered. 

• Underestimating insurance risk due to missing and inaccurate values (e.g., insured 
value). 

Acceptable Data 


LO 40.2: Explain how a firm can set expectations for its data quality and describe 
some key dimensions of data quality used in this process. 


A fundamental step in managing risks due to flawed data would be to set user expectations 
for data quality and then establish criteria to monitor compliance with such expectations. In 
order to define and measure these expectations, they can be categorized into key dimensions 
of data quality. The important (but not complete) set of dimensions that characterize 
acceptable data include accuracy, completeness, consistency, reasonableness, currency, and 
uniqueness. 

Accuracy 

The concept of accuracy can be described as the degree to which data correctly reflects the 
real world object. Measurement of accuracy can occur by manually comparing the data to 
an authoritative source of correct information—for example, the temperature recorded in a 
thermometer compared to the real temperature. 
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Completeness 


Topic 40 

Cross Reference to GARP Assigned Reading - Tarantino and Cernauskas, Chapter 3 


Completeness refers to the extent to which the expected attributes of data are provided. 
There may be mandatory and optional aspects of completeness. For example, it may 
be mandatory to have a customer s primary phone number, but if the secondary phone 
number (optional) is not available, then the data requirement for the phone number is still 
considered complete. 

Note that although data may be complete, it may not necessarily be accurate. For example, 
customers may have moved and their mailing addresses may not have been updated yet. 

Consistency 

Consistency refers to reasonable comparison of values between multiple data sets. The 
concept of consistency is broad and could require that data values from each data set do not 
conflict (e.g., a bank account is closed but the statement still shows account activity) or that 
they meet certain pre-defined constraints. 

Note that consistency does not necessarily imply accuracy. 

There are three types of consistency: 

1. Record level: consistency between one set of data values and another set within the same 
record. 

2. Cross-record level: consistency between one set of data values and another set in different 
records. 

3. Temporal level: consistency between one set of data values and another set within the 
same record at different points in time. 

Reasonableness 

Reasonableness refers to conformity with consistency expectations. For example, the income 
statement value for interest expense should be consistent or within an acceptable range 
when compared to the corresponding balance sheet value for long-term debt. 

Currency 

Currency of data refers to the lifespan of data. In other words, is the data still considered 
relevant and useful, given that the passage of time will gradually render it less current and 
less correct? Measurement of currency would consist of determining the frequency in which 
the data needs to be updated, and determining whether the existing data is still up-to-date. 

Uniqueness 

Uniqueness of data is tied into the data error involving duplicate records. Uniqueness 
suggests that there can only be one data item within the data set. For example, within a 
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Cross Reference to GARP Assigned Reading - Tarantino and Cernauskas, Chapter 3 

client list, there should only be one Mr. Jack Lee with a date of birth of January 1, 1970 
living at 1234 Anywhere Street in New York City. 

Operational Data Governance 


LO 40.3: Describe the operational data governance process, including the use of 
scorecards in managing information risk. 


Operational data governance refers to the collective set of rules and processes regarding data 
that allow an organization to have sufficient confidence in the quality of its data. 

Specifically, a data governance program should exist that clarifies the roles and 
responsibilities in managing data quality. A data quality scorecard could be used to monitor 
the success of such a program. 

In short, operational data governance aims to detect data errors early on and then set into 
motion the steps needed to sufficiently deal with the errors on a timely basis. As a result, 
there should be minimal or no subsequent impact on the organization. 

Data Quality Inspection vs. Data Validation 

Data validation is a one-time step that reviews and assesses whether data conforms to 
defined business specifications. In contrast, data quality inspection is an on-going set of 
steps aimed to: 

1. reduce the number of errors to a tolerable level, 

2. spot data flaws and make appropriate adjustments to allow data processing to be 
completed, and 

3. solve the cause of the errors and flaws in a timely manner. 

The goal of data quality inspection is to catch issues early on before they have a substantial 
negative impact on business operations. 


Data Quality Scorecard 

A base-level metric is straightforward in that it is measured against clear data quality 
criteria. It is relatively easy to quantify whether the criteria is met in terms of arriving at a 
data quality score. 

In contrast, a complex metric is a combined score that could be a weighted average of 
several different metrics (customized to the specific user(s)). Such a combined metric allows 
for a qualitative reporting of the impact of data quality on the organization. A data quality 
scorecard could report the metric in one of three ways: by issue, by business process, or by 
business impact. 
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Cross Reference to GARP Assigned Reading - Tarantino and Cernauskas, Chapter 3 
Complex Metric Scorecard Viewpoints 

Data quality issues view: 

• Considers the impact of a specific data quality problem over multiple business processes. 

• The scorecard shows a combined and summarized view of the impacts for each data 
problem. By going into more detail, one can obtain further information on the sources 
of data problems. This allows for prioritization in terms of solving individual problems. 

Business process view: 

• For each business process, the scorecard has complex metrics that quantify the impact of 
each data quality problem. 

• It allows for the ability to determine exactly where in the business process the data 
problem is originating. This will assist in solving the problem efficiently. 

Business impact view: 

• The scorecard provides a high-level understanding of the risks embedded in data quality 
problems (i.e., a combined and summarized view). It considers various data quality 
problems that occur in various business processes. 

• By going into more detail, one can identify the business processes where the problems 
occur. An even more detailed examination will reveal the specific problems within each 
business process. 

Motivation 

Business managers may wish to take advantage of an opportunity to assess the relationship 
between the impacts of flawed data versus the pre-defined parameters of acceptable data 
quality. Such an assessment could occur with a data quality scorecard, with data being 
measured against the benchmark (acceptable data quality). The scorecard, therefore, 
serves as a strong management technique if it can summarize important organizational 
information as well as provide warning signs to management when corrective actions are 
required. 

Mechanics 

Regardless of the preferred view, a data quality scorecard is comprised of a hierarchy of 
base-level and complex metrics that tie into different levels of accountability within the 
organization. With regard to metrics, the same measurement might be used in different 
contexts, which allows for different error tolerances and weights. Finally, scorecards can be 
customized to present varying levels of detail depending on the intended user(s). 
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Key Concepts 


LO40.1 

Data errors (e.g., missing data, inconsistent data, nonstandard formats) whether they are 
accidental or not, may lead to inconsistent reporting, incorrect product pricing, or failures 
in trade settlement. 


LO 40.2 

Key dimensions that characterize acceptable data include: accuracy, completeness, 
consistency, reasonableness, currency, and uniqueness. 


LO 40.3 

Operational data governance refers to the collective set of rules and processes regarding data 
that allow an organization to have sufficient confidence in the quality of its data. 

Three different viewpoints regarding scorecards include: data quality issues view, business 
process view, and business impact view. 

Data quality scorecards serve as a strong management technique if they are able to 
summarize important organizational information as well as provide warning signs to 
management when corrective actions are required. 
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Cross Reference to GARP Assigned Reading - Tarantino and Cernauskas, Chapter 3 


Concept Checkers 


1. Ryan Vail is a corporate manager who recently made a series of incorrect business 
decisions as a result of faulty data obtained internally. Which of the following 
negative business impacts best describes his incorrect decisions? 

A. Compliance impact. 

B. Confidence-based impact. 

C. Financial impact. 

D. Risk impact. 

2. Data consistency is important to ensure that there are no clear conflicts in data 
values between data sets. WTiich of the following types of data consistency refers to 
consistency between one set of data values and another set of data values in different 
records? 

A. Record level. 

B. Temporal level. 

C. Cross-record level. 

D. Cross-temporal level. 

3. WTich of the following data issues is least likely to increase risk for an organization? 

A. Duplicate records. 

B. Data normalization. 

C. Nonstandard formats. 

D. Data transformations. 

4. WTich of the following statements regarding data quality inspection is correct? It 
attempts to: 

A. catch errors early in the process. 

B. reduce the number of errors to zero. 

C. solve the cause of any errors immediately. 

D. review and assess whether data conforms with defined business specifications. 

5. Which of the following viewpoints regarding data quality scorecards is best described 
as providing a high-level understanding of the risks embedded in data quality 
problems? 

A. Business impact view. 

B. Business process view. 

C. Data quality issues view. 

D. Data process issues view. 
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Concept Checker Answers 


1. B An example of a confidence-based (negative) impact Avould be a manager who makes 

incorrect business decisions based on faulty data. 

2. C Record level consistency is consistency between one set of data values and another set within 

the same record. Cross-record level consistency is consistency between one set of data values 
and another set in different records. 

3. B Data normalization is a process to better organize data in order to minimize redundancy 

and dependency, so it is least likely to increase risk. All of the other data issues are likely to 
increase risk, especially complex data transformations. 

4. A Data quality inspection is intended to catch issues early on before they have a substantial 

negative impact on business operations. The idea is to reduce the number of errors to a 
tolerable level, not necessarily to zero. In addition, it aims to solve the cause of the errors in a 
timely manner, not necessarily immediately. 

5. A With the business impact view, the scorecard provides a high-level understanding of the risks 

embedded in data quality problems (i.e., a combined and summarized view). It considers 
various data quality problems that occur in various business processes. 


Page 42 


©2018 Kaplan, Inc. 





The following is a review of the Operational and Integrated Risk Management principles designed to address 
the learning objectives set forth by GARP®. This topic is also covered in: 

OpRisk Data and Governance 


Topic 41 


Exam Focus 

This topic discusses the seven level 1 categories of operational risk (OpRisk) events defined 
in Basel II and describes level 2 examples of operational risk events for each category. For 
the exam, understand how the collection and reporting of loss data, the risk control self 
assessment (RCSA), identification of key risk indicators (KRIs), and scenario analysis are all 
important elements of a firms OpRisk process. Also, be familiar with the OpRisk profiles 
across various financial sectors with emphases on the highest frequency percentages and 
severity percentages. Finally, be prepared to describe the typical progression through four 
organizational risk designs for large firms. 


Event-Driven Risk Categories 


LO 41.1: Describe the seven Basel II event risk categories and identify examples of 
operational risk events in each category. 


Basel II provides seven categories of level 1 loss events that most firms have adopted to 
meet their own operational risk (OpRisk) framework requirements. OpRisk models are 
concerned with identifying and mitigating operational risks of the firm that are a function 
of people, systems, and external events. The seven Basel II event risk categories are 
described in Figure 1 and are intended to capture all potential operational risks. Every loss 
event should be mapped to the risk event categories outlined in the firms operational risk 
management policies and procedures. However, some loss events may fall under more than 
one category. 

It is important to recognize that the severity and frequency of losses can vary dramatically 
among the categories. For example, loss events are small but occur very frequently in the 
Execution, Delivery, and Process Management category. Whereas, losses are much less frequent 
but typically have a large dollar amount in the Clients, Products, and Business Practices 
category as these loss events commonly arise from substantial litigation suits. 

The modeling of loss event data differs for each category. Thus, it is important to make sure 
every event is placed in the appropriate group. When assigning loss events, consistency is 
more important than accuracy. Effective operational risk management requires that similar 
events are consistently categorized the same way. If mistakes are made classifying risks in 
past years it will impact the risk management control process and reporting to regulators. In 
order to properly classify risks, it is important for the firm to perform a comprehensive risk 
mapping exercise that details every major process of the firm. The process of identifying and 
classifying risks is commonly referred to as OpRisk taxonomy. 
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Cross Reference to GARP Assigned Reading - Cruz, Chapter 2 


Figure 1: Level 1 Categories of Operational Risk Events 


Event Category 

Definition 

Execution, Delivery, and 
Process Management 

Losses from failed transaction processing or process management 
from relations with trade counterparties and vendors. 

Clients, Products, 
and Business Practices 

Losses arising from unintentional or negligent failures to meet a 
professional obligation to specific clients (including fiduciary and 
suitability requirements) or from the nature or design of a product. 

Business Disruption 
and System Failures 

Losses arising from disruption of business or system failures. 

Internal Fraud 

Losses due to acts intended to defraud, misappropriate property, or 
circumvent regulations, the law, or company policy. 

External Fraud 

Losses due to acts intended to defraud, misappropriate property, or 
circumvent the law, by a third party. 

Employment Practices 
and Workplace Safety 

Losses arising from acts inconsistent with employment, health, or 
safety laws or agreements, from payment of personal injury claims, 
or from diversity/discrimination events. 

Damage to 

Physical Assets 

Losses arising from loss or damage to physical assets from natural 
disaster or other events such as vandalism or terrorism. 


Source: Basel Committee on Banking Supervision, Annex 9, Basel II: International Convergence of 
Capital Measurement and Capital Standards: A Revised Framework, 2006. 

Each of these seven level 1 categories identified in Figure 1 is then further broken down into 
a level 2 subcategory. As mentioned previously, the first two event types in Figure 1 have 
a higher frequency and severity of losses. Thus, it should not be surprising that there are 
more level 2 subcategories for these two event types. The level 2 categories help to further 
classify the type of loss event. Figure 2 identifies the six level 2 categories for the event type 
identified in level 1 as Execution, Delivery, and Process Management (EDPM). 

For financial firms, the EDPM category typically has the highest frequency of occurrence 
compared to the other categories. Business units in financial firms often deal with large 
numbers and executions of transactions. Due to the large volume of transactions on a daily 
basis, miscommunications and data-entry errors are common. For example, in the futures 
market, FX transactions are typically very large in order to compensate for the low margins 
of this product line. Errors in finalizing a transaction even for a few days can result in large 
losses as counterparties will require compensation for the use of funds. Identifying where 
the errors occur and the number of occurrences is necessary for managing these OpRisks. 
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Figure 2: Execution, Delivery, and Process Management (Level 1) 


Level 2 Event Category Examples 

Transaction Capture, Data entry, miscommunication, delivery failure, and accounting 

Execution, & Maintenance errors 


Monitoring & Reporting Mandatory reporting failure, inaccurate external report of loss 

incurred 

Customer Intake & Missing client permissions, incomplete documents 

Documentation 


Customer/Client Account 
Management 

Trade Counterparties 
Vendors & Suppliers 


Unapproved access, incorrect client records with loss incurred, 
negligent loss 

Non-client counterparty misperformance or disputes 
Outsourcing or vendor disputes 


Source: Basel Committee on Banking Supervision, Annex 9, Basel II: International Convergence of 
Capital Measurement and Capital Standards: A Revised Frameworky 2006. 

The second Basel II category listed in Figure 1 is Clients, Products, and Business Practices 
(CPBP). The most common type of loss events in this category arise from disagreements 
between clients and counterparties, as well as regulatory fines for negligent business 
practices and advisory fiduciary duties. Litigation cases are high in the United States and the 
severity of losses is very high even though the frequency of loss events is typically less than 
the EDPM category. Figure 3 provides the level 2 subcategories with examples for the CPBP 
category. 


Figure 3: Clients, Products, and Business Practices (Level 1) 


Level 2 Event Category 

Examples 

Suitability, Disclosure, 

& Fiduciary 

Fiduciary violations, disclosure issues, privacy violation, 
account churning 

Improper Business or 
Market Practices 

Antitrust, improper trade or market practices, insider trading, 
market manipulation 

Product Flaws 

Product defects, model errors 

Selection, Sponsorship, 

& Exposure 

Client guidelines failure or excess client limits 

Advisory Activities 

Advisory performance disputes 


Source: Basel Committee on Banking Supervision, Annex 9, Basel II: International Convergence of 
Capital Measurement and Capital Standards: A Revised Framework, 2006. 

The Business Disruption and System Failures (BDSF) category is far less common than 
the first two Basel II categories. A system crash will result in substantial losses for a firm, 
but most of these losses would be categorized under the EDPM category. The following 
example illustrates a type of BDSF loss. Suppose a banks funding system crashes early in the 
day and is not back online until after the money markets are already closed after 4:00 p.m. 
EST. Due to this system crash, the bank needs to fund an extra $30 billion for the days 
activities. To do so, the bank must make special arrangements with counterparties at a much 
higher cost than the daily average funding cost. Basel II defines failed activity examples 
leading to loss events in the BDSF category as hardware, software, telecommunications, and 
utility outage. 
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The Basel II level 1 External Fraud has only two subcategories: (1) theft and fraud 

and (2) systems security. Examples of activities that are classified under the theft and fraud 
subcategory are theft, forgery, and check kiting. Examples of activities that are classified 
under the systems security subcategory are hacking damage and theft of information with 
monetary losses. 

The Basel II level 1 Internal Fraud also has only two subcategories: (1) 

unauthorized activity and (2) theft and fraud. Examples of activities that are classified under 
unauthorized activity are intentionally not reporting transactions, unauthorized transaction 
type, and the intentional mismarking of positions. Examples of activities that are 
classified under the theft and fraud subcategory are fraud, theft, extortion, embezzlement, 
misappropriation of assets, forgery, tax evasion, and bribes. 

The Basel II level 1 Employment Practices and Workplace Safety {EPWS) category has 
three subcategories: (1) employee relations, (2) safe environment, and (3) diversity and 
discrimination. Examples of activities that can lead to losses in the employee relations 
subcategory are compensation, benefit, termination, and organized labor. Examples of 
activities in the safe environment category are generally liabilities from accidents, employee 
health and safety rules, and workers’ compensation. The last subcategory, diversity and 
discrimination, captures all activities related to discrimination issues. 

The last Basel II level 1 category for OpRisk loss events is Damage to Physical Assets {DPA). 
The only subcategory is disasters and other events. This category and subcategory captures 
all loss events related to natural disasters and human losses from external sources such as 
vandalism and terrorism. 

Collecting and Reporting Internal Loss Data 


LO 41.2: Summarize the process of collecting and reporting internal operational 
loss data, including the selection of thresholds, the timeframe for recoveries, and 
reporting expected operational losses. 


The foundation of an OpRisk framework is the internally created loss database. Any event 
that meets a firms definition of an operational risk event should be recorded in the loss 
event database and classified based on guidelines in the operational risk event policy. Many 
firms adopt Basel II categories at the highest level and then customize lower level entries 
to match their firms specific needs. A minimum of five years of historical data is required 
to satisfy Basel II regulatory guidelines. Collecting and analyzing operational risk events 
provides valuable insights into a firms operational risk exposures. When loss data is not 
collected, it could be perceived by regulators that operational risk management issues are 
not a concern. Usually once a firm begins to collect loss data, the organization gains a new 
appreciation of its operational risks. 

The collection of data is challenging because large amounts of data must be gathered over 
diverse geographical areas. The process of gathering data must ensure that it accurately 
reflects all loss information from all locations. The process should have checks and balances 
to ensure human errors are not present in gathering data and sending it to the central data 
collection point. Basel II regulations require a high degree of reliability in the loss data flow 
from all areas of the financial institution. 
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Financial institutions often create OpRisk filters to identify potential operational events 
used in the calculation of operational losses. These OpRisk filters are typically the most 
expensive cost in the process. However, filters provide important added assurance for 
regulators regarding the accuracy of the data collection process. 

Basel II requirements allow financial institutions to select a loss threshold for loss data 
collection. This threshold amount will have significant implications for the risk profile of 
business units within the firm. OpRisk managers should not set the threshold for collecting 
loss data too low (e.g., $0) if there are business units that have a very large number of 
smaller losses, because it would require a very high amount of reporting. OpRisk managers 
should also not just think in terms of large OpRisk threshold amounts. The following 
example illustrates how setting a threshold too high will bias the total losses and therefore 
the risk profile for a financial institution. 

Suppose the OpRisk manager for Bank XYZ sets the threshold at $50,000. Bank XYZ 
categorized all losses by the amount of the loss into loss brackets or buckets illustrated in 
Figure 4. The first row of Figure 4 states that there were two losses greater than $4,000,000 
in the past year and the total amount of loss from these two events was $18,242,000. These 
two losses accounted for 25.3% of the total losses for the year. If a loss threshold was set 
at $50,000, then the last two rows or 28.3% of the total losses for the year would not be 
reported. Therefore, if the firm did not set a loss threshold for collecting data they would 
show that they actually had $72,136,148 of total losses instead of $51,724,314 (computed 
as $72,136,148 - $4,480,627 - $15,931,207). 


Figure 4: Bank XYZ Total Annual Losses 


Loss Bracket 

Events 

Loss Amount 

Percentage 

Over $4,000,000 

2 

$18,242,000 

25.3% 

$1,000,000 to $4,000,000 

8 

$17,524,400 

24.3% 

$500,000 to $1,000,000 

9 

$7,850,425 

10.9% 

$250,000 to $500,000 

7 

$1,825,763 

2.5% 

$100,000 to $250,000 

10 

$1,784,632 

2.5% 

$75,000 to $100,000 

15 

$1,948,971 

2.7% 

$50,000 to $75,000 

18 

$2,548,123 

3.5% 

$25,000 to $50,000 

50 

$4,480,627 

6.2% 

Less than $25,000 

1230 

$15,931.207 

22.1% 

Total 


$72,136,148 

100.0% 


When quantifying capital requirements, Basel II does not allow recoveries of losses to be 
included in the calculation. Regulators require this rule because gross losses are always 
considered for capital calculations to provide a more realistic view of the potential of large 
losses that occur once every 1,000 years. 

Another important issue to consider in the process of collecting loss data is the timeframe 
for recoveries. The financial crisis of 2007—2009 illustrated that the complexity of some 
loss events can lead to very long time horizons from the start of the loss event to the 
final closure. Complex litigation cases from this financial crisis took five to six years for 
resolutions. Sometimes loss events will take lawyers and OpRisk managers several years to 
estimate the loss amount. 
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While firms could create reserves for these losses, they seldom do to avoid giving the 
impression that they may owe a certain amount prior to reaching a judgment. The fact that 
many firms do not have legal expertise within the firm to handle these complex cases adds 
to the cost, because outsourcing of lawyers is often required. It is important for firms to 
have a policy in place for the processing of large long timeframe losses. 

To help firms know what to report, the International Accounting Standards Board (lASB) 
prepared IAS37, which establishes guidelines on loss provisions or the reporting of expected 
operational losses after the financial crisis in 2007—2009. Three important requirements for 
the reporting of expected operational losses are as follows: 

1. Loss provisions are not recognized for future operating losses. 

2. Loss provisions are recognized for onerous contracts where the costs of fulfilling 
obligations exceed expected economic benefits. 

3. Loss provisions are only recognized for restructuring costs when a firm has a detailed 
restructuring plan in place. 

The IAS37 report states that loss provisions of restructuring costs should not include 
provisions related to relocation of staff, marketing, equipment investments, or distribution 
investments. Loss provisions must be recognized on the balance sheet when the firm has 
a current obligation regarding a past loss event. Balance sheet reporting of loss events is 
required when the firm is likely to be obligated for a loss and it is possible to establish 
a reliable estimate of the amount of loss. Gains from the disposal of assets or expected 
reimbursements linked to the loss should not be used to reduce the total expected loss 
amount. Reimbursements can only be recognized as a separate asset. 


Identifying, Controlling, and Assessing Operational Risk 


LO 41.3: Explain the use of a Risk Control Self-Assessment (RCSA) and key 
risk indicators (KRIs) in identifying, controlling, and assessing operational risk 
exposures. 


The control environment plays an important role in mitigating operational losses. The 
OpRisk manager should map each business unit s processes, risks, and control mechanisms 
associated with the processes. For example, Figure 5 illustrates the equity settlement process 
for an equity trading firm. All major processes for the business unit are identified as the first 
step in managing risks. 


Figure 5: Equity Setdement Process 



A risk control self-assessment (RCSA) requires the documentation of risks and provides a 
rating system and control identification process that is used as a foundation in the OpRisk 
framework. Once the RCSA is created, it is commonly performed every 12—18 months to 
assess the business unit s operational risks. It is common for financial institutions to seek 
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expert opinions to help provide qualitative measures for the effectiveness of the RCSA 
framework. The experts perform an evaluation and color rate the performance in each 
process as Red, Amber, or Green (RAG) to indicate the level of risk based on historical 
process data. 

The following four steps are commonly used in designing an RCSA program: 

1. Identify and assess risks associated with each business units activities. The manager first 
identifies key functions in the firm and performs risk scenarios to assess potential losses, 
the exposure or potential loss amount, and the correlation risk to other important 
aspects of the firm such as financial, reputation, or performance. 

2. Controls are then added to the RCSA program to mitigate risks identified for the firm. 
The manager also assesses any residual risk which often remains even after controls are 
in place. 

3. Risk metrics, such as key risk indicators or internal loss events, are used to measure the 
success of OpRisk initiatives and are linked to the RCSA program for review. These 
risk metrics would also include all available external data and risk benchmarks for 
operational risks. 

4. Control tests are performed to assess how effective the controls in place mitigate 
potential operational risks. 

A major challenge for OpRisk managers is the ability to properly interpret output data of 
the aggregated RCSA framework. Outputs could give managers a false sense of security if 
risks are controlled within tolerances that are set too high. Alternatively, risk managers may 
weight some risks more heavily and take corrective actions that focus too intensively on 
specific “key” measures while spending too little focus on other important variables. 

Key risk indicators (KRIs) are identified and used to quantify the quality of the control 
environment with respect to specific business unit processes. KRIs are used as indicators for 
the OpRisk framework in the same way that other quantitative measures are used in market 
and credit risk models. The collection of reliable data used as KRIs is an important aspect 
of the self-assessment process. The data collection process may be automated to improve the 
accuracy of the data, but there will be costs associated with implementation. Even though 
KRIs may be costly to measure, they provide the best means for measuring and controlling 
OpRisk for the firm. 

Regulators prefer the use of accurate quantitative KRIs in a control environment over more 
qualitative measures that only indicate whether the firm is getting better or worse based on 
historical losses. The more qualitative measures used in the example of the equity trading 
process in Figure 5 can be expanded to incorporate quantitative KRIs. Figure 6 includes 
examples of KRIs for the equity settlement process to help the firm self-assess the quality of 
the risk control environment. 

The first step in creating an OpRisk model is identifying key factors that may be driving 
the success or failure of a business process. For example, the daily trade volume may be 
an important measure used to quantify how well the firm is executing the trade capture 
process. During the exercise of identifying KRIs, assumptions are made to determine proxies 
or inputs that drive the process. For example, execution errors are assumed to be greater 
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on high volume days. Other examples of KRIs that are used to predict execution errors 
are the number of securities that were not delivered, trading desk head count, and system 
downtime. 

An important KRI for the process of matching trades and confirmation is the number of 
unsigned confirmations. KRIs are used as warning lights or red flags that highlight possible 
concerns for the firm. For example, when the number of unsigned confirmations older 
than 30 days as a percentage of total confirmations exceeds target percentages it indicates a 
problem area in the confirmation process. Similarly, the number of disputed collateral calls 
may be a good KRI for the custody and control step. Finally, the number of transactions 
that failed to clear or settle may be a good KRI for the settlement process. 


Figure 6: Key Risk Indicators for an Equity Trading Firm 



Collecting data at the lowest level or the cost center level allows information to be 
aggregated for all locations. This is very advantageous for the RCSA program because the 
OpRisk manager is then able to drill down or disaggregate the total data for the firm to help 
pinpoint where potential concerns may be originating. 

Some additional examples of common internal control factors that are used to explain 
specific business environments are summarized in Figure 7. 


Figure 7: Examples of Business Environment and Internal Control Factors (BEICFs) 


Business Environment 

Factor Description 

Systems 

Minutes system is down or slow 

Information Security 

Number of malware or hacking attacks 

People 

Headcount of employees, experience 

Execution/Processing 

Number of transactions or transaction breaks 


External data such as stock market indices and market interest rate levels are also used in 
RCSA frameworks. For example, increased volatility in the equity market can lead to higher 
volume and higher operational losses for the firm. The insurance industry often relies on 
external databases to gather information on accidents or losses for areas or geographical 
regions they are less familiar with. Banks may also use external databases to gather 
information regarding losses for risks they have not been exposed to and therefore lack any 
relevant internal data. 

Three common methods of gathering external data are: internal development, consortia, 
and vendors. Under the internal development method, the firm gathers and collates 
information from media such as news or magazines. This may be the least expensive 
method, but it may not be as accurate and has the potential to overlook large amounts 
of relevant data. The most popular consortium for banks is the Operational Riskdata 
eXchange Association (ORX), which contains large banks in the financial industry. While 
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this consortium has a relatively low loss reporting threshold, there are often no details on 
the losses and therefore this data can only be used for measurement. There are a number 
of vendors who provide detailed analysis on losses that can be used for scenario analysis. 
However, the loss threshold for vendor data is often much higher and the information may 
not always be accurate. 

Scenario Analysis 


LO 41.4: Describe and assess the use of scenario analysis in managing operational 
risk, and identify biases and challenges that can arise when using scenario analysis. 


Scenario analysis is defined as the process of evaluating a portfolio, project, or asset by 
changing a number of economic, market, industry, or company specific factors. Scenario 
analysis models are especially useful tools for estimating losses when loss experiences related 
to emerging risks are not available to the financial institution. Inputs to scenario analysis 
models are collected from external data, expert opinions, internal loss trends, or key risk 
indicators (KRIs). Expert opinions are typically drawn from structured workshops for 
large financial institutions. However, surveys and individual meetings can also be used to 
gather expert advice. Studies suggest that most financial firms analyze between 50 and 100 
scenarios on an annual basis. 

One of the challenges in scenario analysis is taking expert advice and quantifying this advice 
to reflect possible internal losses for the Arm. The following example illustrates how a Arm 
may create a frequency distribution of loss events that can be used in scenario analysis. 

Figure 8 illustrates data constructed for a financial institution based on expert inputs. 
Information is gathered on loss frequencies for pre-determined loss brackets. Thus, a 
frequency distribution is created to model the probability of losses based on the amount of 
loss on an annual basis. This frequency distribution is then used in the OpRisk framework 
for the firm. 


Figure 8: Scenario Analysis Model for Loss Frequencies 


Loss Bracket 

Number of Losses Frequency 

Over $5,000,000 

3 

1.8% 

$1,000,000 to $5,000,000 

9 

5.4% 

$500,000 to $1,000,000 

18 

10.7% 

$250,000 to $500,000 

25 

14.9% 

$100,000 to $250,000 

41 

24.4% 

$50,000 to $100,000 

71 

42.9% 

Total 

168 

100.0% 
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Biases and Challenges of Scenario Analysis 

One of the biggest challenges of scenario analysis is the fact that expert opinions are always 
subject to numerous possible biases. There is often disparity of opinions and knowledge 
regarding the amount and frequency of losses. Expert biases are difficult to avoid when 
conducting scenario analysis. Examples of possible biases are related to presentation, 
context, availability, anchoring, confidence, huddle, gaming, and inexpert opinion. 

Presentation bias occurs when the order that information is presented impacts the expert s 
opinion or advice. Another similar type of bias is context bias. Context bias occurs when 
questions are framed in a way that influences the responses of those being questioned. In 
the case of scenario analysis, the context or framing of questions may influence the response 
of the experts. 

Another set of biases are related to the lack of available information regarding loss data for 
a particular expert or for all experts. Availability bias is related to the expert s experience in 
dealing with a specific event or loss risk. For example, some experts may have a long career 
in a particular field and never actually experience a loss over $ 1 billion. The availability bias 
can result in over or under estimating the frequency and amount of loss events. A similar 
bias is referred to as anchoring bias. Anchoring bias can occur if an expert limits the range 
of a loss estimate based on personal experiences or knowledge of prior loss events. The 
availability an expert has to information can also result in a confidence bias. The expert 
may over or under estimate the amount of risk for a particular loss event if there is limited 
information or knowledge available for the risk or the probability of occurrence. 

Expert opinions are often obtained in structured workshops that have a group setting. This 
group setting environment can lead to a number of biases. Huddle bias (also known as 
anxiety bias) refers to a situation described by behavioral scientists where individuals in a 
group setting tend to avoid conflicts and not express information that is unique because 
it results from different viewpoints or opinions. An example of a huddle bias would be 
a situation where junior experts do not voice their opinions in a structured workshop 
because they do not want to disagree in public with senior experts. Another concern for 
group environments is the possibility of gaming. Some experts may have ulterior motives 
for not participating or providing useful information in workshops. Another problem 
with workshop settings is the fact that top experts in the field may not be willing to join 
the workshop and prefer to work independently. The lack of top experts then attracts less 
experienced or junior experts who may have an inexpert opinion. These inexpert opinions 
can then lead to inaccurate estimates and poor scenario analysis models. 

One technique that can help in scenario analysis is the Delphi technique. This technique 
originated from the U.S. Air Force in the 1950s and was designed to obtain the most 
reliable consensus of opinions from a group of experts. This technique is useful for many 
applications for analyzing cases where there is limited historical data available. More 
specifically, the Delphi technique is often applied in situations that exhibit some of the 
following issues: 

• Precise mathematical models are not available but subjective opinions can be gathered 
from experts. 

• Experts have a diverse background of experience and expertise, but little experience in 
communicating within expert groups. 


Page 52 


©2018 Kaplan, Inc. 



Topic 41 

Cross Reference to GARP Assigned Reading - Cruz, Chapter 2 

• Group meetings are too costly due to time and travel expenses. 

• A large number of opinions is required and a single face-to-face meeting is not feasible. 

Under the Delphi technique, information is gathered from a large number of participants 
across various business units, areas of expertise, or geographical regions. The information is 
then presented in a workshop with representatives from each area. Recommendations are 
determined by this workshop group and quantified based on a pre-determined confidence 
level. A basic Delphi technique commonly goes through the following four steps: 

1. Discussion and feedback is gathered from a large number of participants who may have 
diverse exposure and experience with particular risks. 

2. Information gathered in step 1 is summarized and presented to a workshop group with 
representatives from various locations or business units surveyed. 

3. Differences in feedback are evaluated from step 2. 

4. Final evaluation and recommendations are made based on analysis of data and feedback 
from participants and/or respondents. 

Operational Risk Profiles 


LO 41.5: Compare the typical operational risk profiles of firms in different 
financial sectors. 


Various business units within a financial institution are identified separately in an OpRisk 
profile. This allows the OpRisk manager to gather data for specific risks of each business 
unit. For example, an asset management unit typically has greater legal liability problems 
whereas an investment bank unit has more losses associated with transaction processing 
operational errors. 

Basel II defines level 1 business units into the following categories: Trading and Sales, 
Corporate Finance, Retail Banking, Commercial Banking, Payment and Settlement, Agency 
Services, Asset Management, and Retail Brokerage. Large financial institutions typically 
define business units within their firm based on these Basel II definitions. 

Figures 9 and 10 contrast the OpRisk profiles for five of these financial business units with 
respect to frequency and severity, respectively. The first columns of Figure 9 and Figure 10 
summarize the type of event risk for each business unit. The frequency percentages based 
on the number of loss events are presented for each business unit in Figure 9. The severity 
percentages based on total dollar amount losses are presented for each business unit in 
Figure 10. 
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Figure 9: OpRisk Profiles Showing Frequency (%) 



Trading 

Corporate 

Retail 

Asset 

Retail 

Event Type 

& Sales 

Finance 

Banking 

Management 

Brokerage 

Internal Fraud 

1.0% 

1.6% 

5.4% 

1.5% 

5.8% 

External Fraud 

1.0% 

5.4% 

40.3% 

2.7% 

2.3% 

Employment Practices 

3.1% 

10.1% 

17.6% 

4.3% 

4.4% 

Clients, Products, 






& Business Practices 

12.7% 

47.1% 

13.1% 

13.7% 

66.9% 

Physical Asset Damage 

0.4% 

1.1% 

1.4% 

0.3% 

0.1% 

System Failures 






& Business Disruptions 

5.0% 

2.2% 

1.6% 

3.3% 

0.5% 

Execution, Delivery, & Process Mgt 

76.7% 

32.5% 

20.6% 

74.2% 

20.0% 

Source: 2008 Loss Data collection exercise for Operational Risk BCBS (2009) 


Figure 10: OpRisk Profile Showing Severity (%) 





Trading 

Corporate 

Retail 

Asset 

Retail 

Event Type 

& Sales 

Finance 

Banking 

Management 

Brokerage 

Internal Fraud 

11.0% 

0.2% 

6.3% 

11.1% 

18.1% 

External Fraud 

0.3% 

0.1% 

19.4% 

0.9% 

1.4% 

Employment Practices 

2.3% 

0.6% 

9.8% 

2.5% 

6.3% 

Clients, Products, 






& Business Practices 

29.0% 

93.7% 

40.4% 

30.8% 

59.5% 

Physical Asset Damage 

0.2% 

0.0% 

1.1% 

0.2% 

0.1% 

System Failures 






&: Business Disruptions 

1.8% 

0.0% 

1.5% 

1.5% 

0.2% 

Execution, Delivery, & Process Mgt 

55.3% 

5.4% 

21.4% 

52.8% 

14.4% 


Source: 2008 Loss Data collection exercise for Operational Risk BCBS (2009) 

The two categories with the largest percentage of losses are emphasized in bold across 
different business units. The Clients, Products, and Business Practices (CPBP) unit and the 
Execution, Delivery, and Process Management (EDPM) unit have the largest losses across 
business units in terms of both frequency and severity of losses. 

The number of losses related to the EDPM unit represented the highest frequency 
percentage and severity percentage for the Trading and Sales business unit in a 2008 survey 
of financial institutions. This is expected based on the number of trades executed daily 
by this business unit. Within this business unit, traders are required to execute trades for 
their firm or clients and then later settle the transactions. The complexity and wide range 
of products processed increases the possibility that errors may occur in the process. There 
is also a high frequency percentage and severity percentage related to the CPBP unit. 

Losses within this category arise from client or counterparty disputes, regulatory fines, and 
improper advisory activities. 

The Corporate Finance business unit primarily provides consulting regarding initial public 
offerings, mergers and acquisitions, and other strategic planning. Figure 10 suggests that 
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over 93% of losses fall under the CPBP category. The majority of losses are from litigation 
from clients arguing IPOs were mispriced or some other improper advice. 

The Retail Banking unit has the highest frequency of losses associated with external frauds at 
40%. However, external fraud accounts for only about 20% of the total severity percentage. 

The largest severity percentage for the retail banking sector is the Clients, Products, and 
Business Practices category with Execution, Delivery, and Process Management as the next 
highest category. 

Prior to the financial crisis of 2007—2009, Asset Management firms had steady increases in 
assets under management (AUM) as profits were realized across most financial markets in 
the bull market. Thus, most asset managers did not focus on operational costs. Conversely, 
after the crisis all costs became extremely important as AUM were reduced by as much as 
40%. The lack of proper controls increased the losses beyond market related losses. 

In addition to the financial crisis, one litigation case reached an unprecedented level and 
brought an added demand for increased controls. Bernie MadofPs Ponzi scheme caused 
many individuals to lose all of their investments and pension savings. These events have 
led to dramatic increases in OpRisk controls for the asset management industry. The asset 
management industry reduced operational costs by consolidating administration and 
distribution departments for large geographical regions. In addition, more focus is now 
concentrated toward reducing operational costs and risk management. Productivity has also 
seen changes as illustrated by select financial firms significantly reducing the number of 
products offered to focus on fewer products on a global scale. 

OpRisk, market risk, and credit risk are all concerns for asset management firms. However, 
economic losses are largely due to OpRisk losses, because credit and market risks do 
not have an immediate impact on manager fee income. The OpRisk profile for asset 
management firms reveals the largest frequency and severity percentage in the Execution, 

Delivery, and Process Management area. 

The OpRisk profile for firms in the Retail Brokerage industry can vary to some extent due 
to the wide range of business strategies ranging from online to brick-and-mortar broker- 
dealers. Changes in technologies have significantly increased the speed of trading and clients 
of broker-dealers now have direct market access through trading tools. Clients such as 
hedge funds, mutual funds, insurance companies, or wealthy individuals are able to directly 
access markets using the broker-dealers market participant identifier (MPID). This greatly 
increases the operational risk for broker-dealers who are responsible for all trades made with 
their MPID. If trades are not filtered by the broker-dealer, then the risks are even greater. 

For example, due to the high speed of trades driven by algorithms and large blocks of trades, 
a two-minute delay in detecting a mistake could lead to losses approaching three-quarters 
of a billion dollars. Thus, it is important to integrate pre-trade controls into the system 
to mitigate the risk of mistakes or entry errors. The OpRisk profile of the retail brokerage 
industry has the largest frequency and severity percentage in the Clients, Products, and 
Business Practices area. 

There was no loss frequency or severity data provided for the Insurance sector. Perhaps 
this is due to the fact that firms in the insurance industry are still in the early stages of 
developing accurate OpRisk frameworks and there is no data available. The insurance sector 
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is divided into three major insurance types: life, health, and property and casualty. The 
insurance industry collects premiums for insuring individual losses and the insurer pays 
for losses incurred by policyholders, thus reducing the possibility of a large loss for any one 
individual. 

In order to properly price the premiums, the insurer must have accurate actuarial 
calculations. In fact, OpRisk capital requirement models determined by regulators are 
designed after actuarial calculation models in the property and casualty insurance industry. 
Some major OpRisks for insurers include misselling products to clients, fraudulent sales 
techniques, customer frauds, discrimination litigation, and incomplete policy litigation 
following the 9/11 attacks. 


Organizational Structures for Risk Governance 


LO 41.6: Explain the role of operational risk governance and explain how a firms 
organizational structure can impact risk governance. 


A key factor in creating a successful OpRisk framework is the organizational design of the 
risk management framework. Developing an understanding of reporting lines is just as 
important as developing good measurement tools and key risk indicators. All stakeholders 
for the organization should be informed of the OpRisk framework to help ensure that data 
is collected accurately and reflects the systems in place. The way in which risk is managed in 
an organization and the internal governance is an important aspect of OpRisk management. 

There are four main organizational designs for integrating the OpRisk framework within 
the organization. Most large firms start at design 1 and progress to design 4 over time. The 
four organizational designs are illustrated in Figure 11 and summarized below. 

Design 1: Central Risk Function Coordinator 

In the first risk organizational design, the risk manager is viewed more as a coordinator or 
facilitator of risk management. This risk management design typically involves only a small 
Central Risk group who is responsible for OpRisk management. The risk manager gathers 
all risk data and then reports directly to the Chief Executive Officer (CEO) or Board of 
Directors. Regulators believe there exists a conflict of interest for reporting risk data directly 
to management or stakeholders that are primarily concerned with maximizing profits. 

Thus, this design can only be successful if business units are responsive to the Central Risk 
function without being influenced by upper management who controls their compensation 
and evaluates their performance. 

Design 2: Dotted Line or Matrix Reporting 

Creating a link or dotted line from the business risk managers to the Central Risk function 
of the organization is the next natural progression in risk organizational design. The 
dotted line implies that business unit managers are still directly under the influence of the 
CEO who controls their compensation and evaluates their performance. Thus, this type 
of framework is only successful if there is a strong risk culture for each business unit that 
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encourages collaboration with the Central Risk function. Furthermore, this dotted line 
structure is preferred when there is a culture of distrust of the Central Risk function based 
on some historical events. 

Design 3: Solid Line Reporting 

For larger firms that have centralized management, the solid line reporting is more popular. 

The solid line indicates that each business unit has a risk manager that reports directly to 
the Central Risk function. This design enables the Central Risk function to more effectively 
prioritize risk management objectives and goals for the entire firm. The solid line reporting 
also creates a more homogeneous risk culture for the entire organization. 

Design 4: Strong Central Risk Management 

Many large firms have evolved into a strong central risk management design either 
voluntarily or from regulatory pressure. Under this design, there is a Corporate Chief Risk 
Officer who is responsible for OpRisk management throughout the entire firm. The Central 
Risk Manager monitors OpRisk in all business units and reports directly to the CEO or 
Board of Directors. Regulators prefer this structure as it centralizes risk data which makes 
regulatory supervision easier for one direct line of risk management as opposed to numerous 
risk managers dispersed throughout various business units of the firm. 

Figure 11: Risk Department Organizational Designs 


1. Central Risk Function Coordinator 


2. Matrix Reporting (Dotted Line) 




3. Central Risk Management (Solid Line) 4. Strong Central Risk Management 
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Cross Reference to GARP Assigned Reading - Cruz, Chapter 2 


Key Concepts 


L0 41.1 

Basel II classifies loss events into seven categories. Loss events in the Execution, Delivery, 
and Process Management category have a small dollar amount but a very large frequency of 
occurrence. Losses are more infrequent but very large in the Clients, Products, and Business 
Practices category. 


L0 41.2 

Thresholds for collecting loss data should not be set too low if there are business units 
that have a very large number of smaller losses. Another important issue to consider in the 
process of collecting loss data is the timeframe for recoveries. Time horizons for complex 
loss events can stretch out for as much as five years or longer. 

The International Accounting Standards Board (lASB) prepared IAS37, which states 
that loss provisions: (1) are not recognized for future operating losses, (2) are recognized 
for onerous contracts where the costs of fulfilling obligations exceed expected economic 
benefits, and (3) are only recognized for restructuring costs when a firm has a detailed 
restructuring plan in place. 


L0 41.3 

Risk control self-assessment (RCSA) requires the assessment of risks that provides a rating 
system and control identification process for the OpRisk framework. Key risk indicators 
(KRIs) are used to quantify the quality of the control environment with respect to specific 
business unit processes. 


L0 41.4 

Expert opinions are drawn from structured workshops and used as inputs in scenario 
analysis models. A challenge for scenario analysis is that these expert opinions may contain 
the following biases: presentation, context, availability, anchoring, huddle, gaming, 
confidence, and inexpert opinion. 


L0 41.5 

In general, the Clients, Products, and Business Practices unit and the Execution, Delivery, 
and Process Management unit have the largest losses based on OpRisk profiles across 
financial sectors in terms of severity and frequency of losses. 


L0 41.6 

There are four main organizational designs for integrating an OpRisk framework. Most 
large firms evolve from design 1 to design 4 over time. The primary difference in the designs 
is how risk is reported and the link between separate business unit risk managers and the 
Central Risk function. 
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Concept Checkers 


1. Suppose a broker-dealer has a loss that occurs from a failure in properly processing 
and settling a transaction. According to Basel II operational risk categories, this type 
of event loss would be categorized as: 

A. Business Disruption and System Failures. 

B. Clients, Products, and Business Practices. 

C. Execution, Delivery, and Process Management. 

D. Employment Practices and Workplace Safety. 

2. There are typically four steps used in designing the risk control self-assessment 
(RCSA) program for a large firm. Which of the following statements is least likely to 
be a step in the design of that program? 

A. Identify and assess risks associated with each business unit s activities. 

B. Controls are added to the RCSA program to mitigate risks identified for the 
firm. 

C. Risk metrics and all other OpRisk initiatives are linked to the RCSA program. 

D. Reports to regulators are prepared that summarize the degree of OpRisk. 

3. Scenario analysis is often used by financial institutions in determining the amount 
and frequency of losses. Because historical data is often limited for all possible losses, 
the opinions of experts are often obtained from workshops. These expert opinions 
are often subject to biases. Which of the following biases refers to the problem 

that can arise in this group setting where an expert may not be willing to share a 
conflicting opinion? 

A. Huddle bias. 

B. Context bias. 

C. Availability bias. 

D. Anchoring bias. 

4. Based on OpRisk profiles across financial sectors, which of the following loss event 
type categories have the highest frequency and severity of losses? 

A. Business Disruption and System Failures. 

B. Clients, Products, and Business Practices. 

C. External Fraud. 

D. Internal Fraud. 

5. Which of the following risk organizational design frameworks is preferred by 
regulators? 

A. Central risk function coordinator. 

B. Matrix reporting using dotted lines. 

C. Solid line reporting to central risk management. 

D. Strong central risk management. 
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Concept Checker Answers 


1. C Basel II classifies losses from failed transaction processing or process management from 

relations with trade counterparties and vendors under the Execution, Delivery, and Process 
Management category. 

2. D The last step in the design of a risk control self-assessment (RCSA) program involves control 

tests to assess how well the controls in place mitigate potential risks. 

3. A Huddle bias suggests that groups of individuals tend to avoid conflicts that can result from 

different viewpoints or opinions. Availability bias is related to the expert’s experience in 
dealing with a specific event or loss risk. Anchoring bias occurs when an expert limits the 
range of a loss estimate based on personal knowledge. Context bias occurs when questions 
are framed in a way that influences the responses of those being questioned. 

4. B From the choices listed the Clients, Products, and Business Practices unit has the highest 

frequency percentages and severity of loss percentages across business units. The Execution, 
Delivery, and Process Management unit also has large losses across business units in terms of 
frequency and severity of losses, however, this category was not listed as a possible choice. 

5. D Regulators prefer the strong central risk management design because they can streamline 

their supervision over one direct line of risk management as opposed to numerous risk 
managers throughout the firm. 
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The following is a review of the Operational and Integrated Risk Management principles designed to address 
the learning objectives set forth by GARP®. This topic is also covered in: 

External Loss Data 


Topic 42 

Exam Focus 

This topic examines the motivations for using external operational loss data and compares 
characteristics of loss data from different sources. For the exam, understand why firms are 
motivated to use external data in their internal operational risk framework development 
and the types of data that are available. Also, understand the differences in construction 
methodologies between the ORX and FIRST databases and be able to cite examples of how 
these differences manifest themselves in the data. Finally, be able to describe the Societe 
Generale operational loss event. 


Collecting External Loss Data 


LO 42.1: Explain the motivations for using external operational loss data and 
common sources of external data. 


One reason operational risk departments look at events outside the firm is to gain valuable 
insights and inputs into operational risk capital calculations. Furthermore, external data is a 
required element in the advanced measurement approach (AMA) capital calculation under 
Basel II. 

External events can be useful in many areas of the firms operational risk framework, as 
these events provide information for risk self-assessment activities. They are key inputs in 
scenario analysis and can help in developing key risk indicators for monitoring the business 
environment. 


Figure 1: External Loss Data in the Operational Risk Framework 
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Senior management should take an interest in external events because news headlines can 
provide useful information on operational risk. Examining events among industry peers 
and competitors helps management understand the importance of effective operational risk 
management and mitigation procedures. This is why external data is the key to developing a 
strong culture of operational risk awareness. 
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An example of a huge risk event that impacted industry discipline is the €4.9 billion trading 
scandal at Societe Generale in 2006. This internal loss for Societe Generale demonstrated 
to the financial services industry how operational risk can lead to large losses. In spite of the 
lessons learned from this experience, the financial industry saw another huge trading loss 
event at UBS in 2011, which led firms to reassess how they respond to external events and 
to ensure any lessons learned do not go unheeded. 

Sources of External Loss Data 

There are many sources of operational risk event data in the form of news articles, journals, 
and email services. Operational risk system vendors offer access to their database of events, 
and there are consortiums of operational risk losses as well. External events are a valuable 
source of information on individual events and also serve as a benchmarking tool for 
comparing internal loss patterns to external loss patterns. This process provides insight into 
whether firm losses are reflective of the industry. 

Subscription Databases 

Subscription databases include descriptions and analyses of operational risk events derived 
from legal and regulatory sources and news articles. This information allows firms to map 
events to the appropriate business lines, risk categories, and causes. The primary goal of 
external databases is to collect information on tail losses and examples of large risk events. 
An excerpt showing the total operational risk loss percentages to date by risk category in the 
IBM Algo FIRST database is shown in Figure 2. 


Figure 2: Operational Risk Losses Recorded in IBM Algo FIRST (Q4 2012) 


Event Type 

% of Losses 

% of Events 

Business Disruption and System Failures 

0.41% 

1.54% 

Clients, Products, and Business Practices 

48.25% 

46.11% 

Damage to Physical Assets 

19.22% 

3.18% 

Employment Practices and Workplace Safety 

0.88% 

5.97% 

Execution, Delivery, and Process Management 

6.68% 

7.28% 

External Fraud 

3.94% 

9.71% 

Internal Fraud 

20.63% 

26.20% 

Total 

100% 

100% 


Through these statistics, we can see some patterns in operational risk events. For example, 
46% of all records fall into the category of Clients, Products, and Business Practices, 
accounting for 48% of dollar value losses. Internal Fraud is another large area of risk 
events, with 26% of records and 21% of losses. Damage to Physical Assets is the next most 
expensive category with 19% of losses but only 3% of events. 
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Figure 2 shows us that within an internal database such IBM Algo FIRST (FIRST), 
operational risk losses from Internal Fraud, Damage to Physical Assets, and Client, 

Products, and Business Practices are more significant than those from other categories. 

However, keep in mind that the FIRST database includes business lines that are not part of 
the Basel-specified business lines. This results in relatively high Damage to Physical Assets 
losses, as insurance company losses are included in that category. 

In Figure 3, we see subsets of losses from the FIRST database. (Note that any losses not 
attributed to one of the Basel business lines have been removed.) 


Figure 3: FIRST Losses by Business Line (Q4 2012) 


Business Line 

% of Losses 

% of Events 

Agency Services 

0.35% 

2.22% 

Asset Management 

14.40% 

16.37% 

Commercial Banking 

23.42% 

17.70% 

Corporate Finance 

17.56% 

9.00% 

Payment and Settlement 

2.72% 

5.90% 

Retail Banking 

23.67% 

20.79% 

Retail Brokerage 

1.30% 

10.33% 

Trading and Sales 

16.58% 

17.70% 

Total 

100% 

100% 


Figure 3 shows about 10% of events occur in the Retail Brokerage business line, but these 
retail brokerage events account for only 1 % of losses because average losses in this business 
line are relatively small. Conversely, we see that Corporate Finance generated 9% of events 
but accounted for 18% of losses. Clearly, average losses in Corporate Finance tend to be 
more expensive. 

We should keep in mind that this analysis is based on publicly available data for operational 
risk events, which is subject to reporting bias. The FIRST database is useful for financial 
services firms to compare their risk profiles to the industry by category and business line. 
FIRST provides insights into events that may not have occurred at a particular firm in the 
risk modeling process. 

Consortium Data 

Besides the FIRST approach to collecting data, there are also consortium-based risk 
event services that provide a central data repository. Operational Riskdata eXchange 
Association (ORX) is a provider of this data, which is gathered from members to provide 
benchmarking. ORX applies quality assurance standards to keep all receipt and delivery of 
data anonymous and to provide consistency in definitions of events. 

Unlike subscription services, ORX data does not suffer from the availability bias that skews 
the FIRST data (which relies on public sources of information). With ORX, all events are 
entered anonymously into the database; however, the data relates only to a small subset 
of firms that are members of the consortium. ORX also uses different business lines than 
FIRST. For example, it splits retail banking into two groups: Retail Banking and Private 
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Banking. It also renames Payment and Settlement to “Clearing.” The ORX database has 
gathered nearly 30,000 events costing its members over €100 billion, which helps highlight 
the potential costs of operational risk. 

ORX publishes reports that summarize the number and amount of losses for each business 
line and risk category. Regarding the reported contributions, the Retail Banking business 
area generates 58% of events; most of them in the External Fraud category. Trading and 
Sales and Commercial Banking follow with about 10% of total events each. Retail Banking 
has the biggest share of total costs at 46% of total losses. Execution, Delivery, and Process 
Management produce the largest number of events (36%), with 25% of total costs. Also, 
Clients, Products, and Business Practices accounts for about 17% of events but more than 
50% of losses, which demonstrates that for members of ORX, these events tend to be large. 
Many firms use information from this category to conduct scenario analysis for potential 
“fat tail” events. Data representing dollar value losses of operational risk for each business 
line is shown in Figure 4. 


Figure 4: Dollar Value Losses by Risk Category and Business Line 
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LO 42.2: Explain ways in which data from different external sources may differ. 


Differences in the collection methods between the ORX and the FIRST databases have an 
interesting impact on the relative distribution of the loss data. 

Size and Frequency of Losses by Risk Category 

When comparing the size of losses by risk category in the ORX and FIRST databases, we 
see that the FIRST database has a significantly higher percentage of losses for Internal Fraud 
than ORX does. In contrast, ORX has a significantly higher percent of Execution, Delivery, 
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and Process Management losses than does FIRST. This could be because not all Execution, 

Delivery, and Process Management losses are reported by the press, implying that the 
FIRST database is missing many events and has an unavoidable collection bias. 

The primary difference between these two databases with respect to Execution, Delivery, 
and Process Management events is that ORX data is supplied directly from member banks, 
which does not include all banks, implying that ORX also suffers from collection bias. This 
is in contrast to the FIRST database that collects data on all firms, including a significant 
number of firms outside of Basel II compliance. 

Regarding the frequency of losses by risk category. Execution, Delivery, and Process 
Management events are missing from FIRST data, presumably because they rarely get press 
coverage. ORX has a larger frequency of External Fraud than FIRST, which suggests that 
such events are often kept from the press. ORX data also shows a large amount of External 
Fraud due to the participation of retail banks in the consortium. This is because Retail 
Banking includes credit card services, which causes this category to be driven by numerous 
small instances of fraud in retail banking and credit cards. The threshold for reporting loss 
data to ORX is €20,000. 

Size and Frequency of Losses by Business Line 

When comparing the size of losses by business lines in the ORX and FIRST databases, 

ORX losses are heavily weighted toward Retail Banking. Also, Commercial Banking 
accounts for a smaller percentage of losses for ORX than for FIRST, which may be due to 
recent commercial banking events making it into the press and, therefore, into the FIRST 
database (but not the ORX database). 

Regarding the frequency of losses by business line, ORX data is driven by Retail Banking 
events, whereas FIRST events are more evenly distributed among the various business lines. 

Also, the majority of events for ORX and FIRST occur in Retail Banking but by a slimmer 
margin for the FIRST database. 


Challenges with Using External Data 


LO 42.3: Describe the challenges that can arise through the use of external data. 


Many firms’ operational risk systems not only include ORX and FIRST data but are also 
supplemented with information from the firms own research and relevant industry news 
and journals. However, as we noted previously about the various differences between ORX 
and FIRST, the databases must be viewed with caution, as there are several challenges with 
using external data. 

For example, external data derived from the media is subject to reporting bias. This is 
because it is up to the press to decide which events to cover, and the preference is for illegal 
and dramatic acts. For instance, consider that a large internal trading fraud might get press 
coverage, while a systems outage might get none. We should also consider that a major gain 
is less likely to be reported by the media than a major loss. Another barrier to determining 
whether an event is relevant is that some external events may be ignored because they are 
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perceived as types of events that “could not happen here.” Finally, the use of benchmark 
data may be a concern because there is a chance that comparisons may not be accurate due 
to different interpretations of the underlying database definitions. 

One of the best ways to use external data is not to spot exact events to be avoided but rather 
to determine the types of errors and control failings that could cause similar losses. External 
data may have direct relevance despite differences in the details. For example, the Societe 
Generale event led many firms to overhaul their fraud controls. 

External data can serve a valuable role in operational risk management if its limitations 
are acknowledged. Databases can provide valuable lessons about risk management and 
highlight trends in the industry. While internal and external databases only tell us about 
what has already gone wrong, the data can be used to implement controls to mitigate the 
chances of similar events repeating, and they provide valuable inputs into the operational 
risk framework. Loss data is also useful for self-assessment, scenario analysis, and key risk 
indicators (KRIs) that indicate loss trends and weaknesses in controls. 


Soci^T^ Generale Operational Loss Event 


LO 42.4: Describe the Soci^t^ Generale operational loss event and explain the 
lessons learned from the event. 


In January 2008, it was discovered that one of Societe Generales junior traders, Jerome 
Kerviel, was involved in rogue trading activities, which ultimately resulted in losses of 
€4.9 billion. The multinational bank was fined €4 million, and Mr. Kerviel was sentenced 
to three years in prison. The incident damaged the reputation of Societe Generale and 
required the bank to raise additional funds to meet capital needs. 

Between July 2005 and January 2008, Kerviel established large, unauthorized positions in 
futures contracts and equity securities. To hide the size and riskiness of these unauthorized 
positions, he created fake transactions that offset the price movements of the actual 
positions. Kerviel created fake transactions with forward start dates and then used his 
knowledge of control personnel confirmation timing to cancel these trades right before 
any confirmations took place. Given the need to continuously replace fake trades with new 
ones, Kerviel created close to 1,000 fictitious trades before the fraud was finally discovered. 

The operational risk world was galvanized by this event as it demonstrated the dangers 
of unmitigated operational risk. In 2008, many firms were developing operational risk 
frameworks and often focused on the delivery of new reporting, loss data tools, and 
adaptions to their scenario analysis programs. However, even though firms were developing 
internal risk systems, the amount of new regulatory requirements rapidly overcame their 
ability to keep up in practice. With the news of Mr. Kerviels activities, many heads of 
operational risk found themselves asking the question “Could that happen here?” 
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IBM Algo FIRST provided an analysis based on press reviews. The highlights of alleged 
contributing factors to this operational loss event are summarized as follows: 

1. Mr. Kerviel was involved in extensive unauthorized trading activities. 

2. Mr. Kerviel was not sufficiently supervised. 

3. Mr. Kerviel used his knowledge of middle and back office controls to ensure his fraud 
went undetected. 

4. Mr. Kerviel achieved password access to systems allowing him to manipulate trade data. 

A number of reasons were cited that explained how Kerviels unauthorized trading activity 
went undetected, including the incorrect handling of trade cancellations, the lack of proper 
supervision, and the inability of the banks trading system to consider gross positions. 

Regarding trade cancellations, the banks system was not equipped to review trading 
information that was entered and later canceled. In addition, the system was not set up to 
flag any unusual levels of trade cancellations. Regarding the lack of supervision, oversight 
of Kerviels trading activity was weak, especially after his manager resigned in early 2007. 

Under the new manager, Kerviels unauthorized trading activity increased significantly. 

Regarding the size of Kerviels positions, the banks system was only set up to evaluate net 
positions instead of both net and gross positions. Thus, the abnormally large size of his 
trading positions went undetected. Had the system properly monitored gross positions, it is 
likely that the large positions would have issued a warning sign given the level of riskiness 
associated with those notional amounts. Also, the large amount of trading commissions 
should have raised a red flag to management. 

Additional reasons that contributed to the unauthorized positions going undetected 
included the inaction of Kerviels trading assistant to report fraudulent activity, the violation 
of the banks vacation policy, the weak reporting system for collateral and cash accounts, 
and the lack of investigation into unexpected reported trading gains. 

Kerviels trading assistant had immediate access to Kerviels trading activities. Because the 
fictitious trades and the manipulation of the banks trading system went unreported, it 
was believed that the trading assistant was acting in collusion with Kerviel. Regarding the 
banks vacation policy, the rule that forced traders to take two weeks of vacation in a row 
was ignored. Had this policy been enforced, another trader would have been responsible for 
Kerviels positions and likely would have uncovered the fraudulent activity of rolling fake 
transactions forward. Regarding collateral and cash reports, the fake transactions did not 
warrant any collateral or cash movements, so nothing balanced the collateral and cash needs 
of the actual trades that were being offset. If Societe Generale s collateral and cash reports 
had been more robust, it would have detected unauthorized movements in the levels of 
these accounts for each individual trader. Regarding reported trading gains, Kerviel inflated 
trading gains above levels that could be reasonably accounted for given his actual authorized 
trades. This action should have prompted management to investigate the source of the 
reported trading gains. 
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Ultimately, the unauthorized trading positions were discovered by chance after one of 

Kerviels fake trades was detected by control personnel during a routine monitoring 

of positions. Kerviels inability to explain the fictitious transaction led to a rigorous 

investigation, revealing the depth of his fraudulent activities. 

Lessons to be learned specific to this operational loss event include the following: 

• Traders who perform a large amount of trade cancellations should be flagged and, as a 
result, have a sample of their cancellations reviewed by validating details with trading 
counterparties to ensure cancellations are associated with real trades. 

• Tighter controls should be applied to situations that involve a new or temporary 
manager. 

• Banks must check for abnormally high gross-to-net-position ratios. High ratios suggest 
a greater probability of unauthorized trading activities and/or basis risk measurement 
issues. 

• Control personnel should not assume the independence of a trading assistant s actions. 
Trading assistants often work under extreme pressure and, thus, are susceptible to 
bullying tactics given that job performance depends on them following direction from 
traders. 

• Mandatory vacation rules should be enforced. 

• Requirements for collateral and cash reports must be monitored for individual traders. 

• Profit and loss activity that is outside reasonable expectations must be investigated 
by control personnel and management. Reported losses or gains can be compared to 
previous periods, forecasted values, or peer performance. 
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Key Concepts 


L0 42.1 

Operational risk departments look at events outside the firm to gain valuable insights 
and inputs into operational risk capital calculations. External events can also be useful in 
many areas of a firms operational risk framework, as they provide information useful for 
risk self-assessment activities. These events are key inputs in scenario analysis and can help 
in developing key risk indicators for monitoring the business environment. Additionally, 
external data is a required element in the advanced measurement approach (AMA) capital 
calculation. 

Subscription databases include descriptions and analyses of operational risk events, which 
are derived from legal and regulatory sources and news articles. In addition to database 
systems, there are also consortium-based risk event services that provide a central data 
repository to member firms and can offer benchmarking services as well. ORX is a provider 
of this type of data. 


LO 42.2 

When comparing data in the FIRST and ORX databases, we see significant differences 
between them. The FIRST database has a significantly higher percentage of losses for 
Internal Fraud than does ORX. In contrast, ORX has a significantly higher percent 
of Execution, Delivery, and Process Management losses. This could be because not all 
Execution, Delivery, and Process Management events are reported by the press, implying 
the FIRST database is missing many events and has an unavoidable collection bias. 

Another difference between the two databases with respect to Execution, Delivery, and 
Process Management events is that ORX data is supplied directly from member banks. 
However, not all banks are ORX members, implying that ORX likely also suffers from 
collection bias. This is in contrast to the FIRST database that collects data on all firms, 
including a significant number of firms outside of Basel II compliance. 


LO 42.3 

ORX and FIRST databases must be viewed with caution, as there are several challenges 
with using external data. For example, external data derived from the media is subject 
to reporting bias because the press is far more likely to cover illegal and dramatic events. 
The use of benchmark data is also a concern, as there is a chance that comparisons are not 
accurate because of different interpretations of the underlying database definitions. 

One of the best ways to use external data is not to spot exact events to be avoided but 
rather to determine the types of errors and control failings necessary to avoid similar 
losses. External data can still have a valuable role in operational risk management if 
staff acknowledges any limitations. Databases can provide valuable lessons about risk 
management and highlight trends in the industry. 
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LO 42.4 

Jerome Kerviel, a junior trader at Societe Generale, participated in unauthorized trading 
activity and concealed this activity with fictitious offsetting transactions. The fraud resulted 
in €4.9 billion in losses and severely damaged the reputation of Societe Generale. 
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Concept Checkers 


1. Which of the following reasons is least likely to be a motivation for firms to use 
external data? 

A. To provide inputs into operational risk calculations. 

B. To engage in risk self-assessment activities. 

C. To ignore any operational loss events outside of external loss databases. 

D. To use in the advanced measurement approach (AMA) capital calculation. 

2. In the IBM Algo FIRST database, which event type accounts for the most risk 
events? 

A. Business Disruptions and Systems Failures. 

B. Execution, Delivery, and Process Management. 

C. Clients, Products, and Business Practices. 

D. Internal Fraud. 

3. Which database is likely to suffer from selection bias for Execution, Delivery, and 
Process Management losses because not all events are reported in the press? 

I. IBM Algo FIRST 

II. Operational Riskdata eXchange Association (ORX) 

A. I only. 

B. II only. 

C. Both I and II. 

D. Neither I nor II. 

4. Which of the following statements is least likely to be a limitation of using external 
databases? External databases: 

A. must be viewed with caution. 

B. suffer from collection biases. 

C. do not report all events. 

D. cannot be used in internal calculations. 

5. Which of the following statements was not a contributing factor to Jerome Kerviels 
activities at Societe Generale? Mr. Kerviel: 

A. engaged in extensive unauthorized activities. 

B. engaged in rogue trading despite being sufficiently supervised. 

C. had knowledge of controls to ensure his activities were not detected. 

D. gained password access to back office systems to manipulate data. 
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Concept Checker Answers 


1. C Operational risk departments look at events outside the firm to gain valuable insights and 

inputs into operational risk capital calculations. Firms should understand that external loss 
databases only include a sample of potential operational loss events. 

2. C Forty six percent of all records in the FIRST database fall into the category of Clients, 

Products, and Business Practices, more than any other category. 

3. A Because not all Execution, Delivery, and Process Management events are reported by 

the press, it is likely that the FIRST database is missing many events and, thus, has an 
unavoidable collection bias. 

4. D The use of external databases is critical to firms’ operational risk management calculations, an 

example of which is observing fat tail events at other firms. 

5. B Mr. Kerviel was insufficiently supervised according to IBM Algo FIRST. 
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the learning objectives set forth by GARP®. This topic is also covered in: 

Capital Modeling 


Topic 43 

Exam Focus 

This topic discusses approaches for modeling operational risk capital requirements. 

Collecting data for loss frequency and loss severity distributions is an important component 
of allocating operational risk capital among various bank business lines. The loss distribution 
approach (LDA) models losses with respect to both frequency and severity with the goal of 
determining the appropriate level of capital. For the exam, be able to compare the approaches 
for calculating operational risk capital charges and be able to describe the LDA for modeling 
capital. Approaches for calculating operational risk capital requirements will be covered again 
in Topics 44 and 58. 


Operational Risk Capital Requirements 


LO 43.1: Compare the basic indicator approach, the standardized approach, and 
the alternative standardized approach for calculating the operational risk capital 
charge, and calculate the Basel operational risk charge using each approach. 


Basel II proposed three approaches for determining the operational risk capital requirement 
(i.e., the amount of capital needed to protect against the possibility of operational risk 
losses). The basic indicator approach (BIA) and the standardized approach (TSA) 
determine capital requirements as a multiple of gross income at either the business line or 
institutional level. The advanced measurement approach (AMA) offers institutions the 
possibility to lower capital requirements in exchange for investing in risk assessment and 
management technologies. If a firm chooses to use the AMA, calculations will draw on the 
underlying elements illustrated in Figure 1. 

Figure 1: Role of Capital Modeling in the Operational Risk Framework 
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Basel II encourages banks to develop more sophisticated operational risk management 
tools and expects international banks to use either the standardized approach or advanced 
measurement approach. In fact, many nations require large financial institutions to calculate 
operational risk with the AMA in order to be approved for Basel II. 


Basic Indicator Approach 


With the BIA, operational risk capital is based on 15% of the banks annual gross income 
(GI) over a three-year period. Gross income in this case includes both net interest income 
and noninterest income. The capital requirement, Kgj^, under this approach is computed as 
follows: 


KbIA — 


^Gljxa 

.i=l 


n 


where: 

GI = annual (positive) gross income over the previous three years 
n = number of years in which gross income was positive 
OL =15% (set by Basel Committee) 


Firms using this approach are still encouraged to adopt the risk management elements 
outlined in the Basel Committee on Banking Supervision, Risk Management Group, 
“Sound Practices for the Management and Supervision of Operational Risk.” When a 
firm uses the BIA, it does not need loss data, risk and control self-assessment, scenario 
analysis, and business environment internal control factors (BEICF) for capital calculations. 
However, these data elements are needed as part of an operational risk framework to ensure 
risks are adequately identified, assessed, monitored, and mitigated. 


Example 1: Calculating BIA capital charge 

Assume Omega Bank has the following revenue results from the past three years: 



Year 1 

Year 2 

Year 3 

Annual Gross Revenue (in $ 100 millions) 

25 

30 

35 


Calculate the operational risk capital requirement under the BIA. 

Answer: 

^ _[(25 + 30 + 35)x0.15]_ _ 

^BiA --;-- 

Thus, Omega Bank must hold $450 million in operational risk capital under Basel II 
using the basic indicator approach. 
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Example 2: Calculating BIA capital charge 

Assume Theta Bank has the following revenue results from the past three years: 


Year 1 

Year 2 

Year 5 

Annual Gross Revenue (in $100 millions) 10 

-5 

15 


Calculate the operational risk capital requirement under the BIA. 

Answer: 

Because Year 2 is negative, it will not count toward the sum of gross income over the past 
three years. This will also reduce the value of n to two. 

|(10 + 15)x0.15| 

^BIA “ - 

Thus, Theta Bank must hold $187.5 million in operational risk capital under Basel II 
using the basic indicator approach. 


The BIA for risk capital is simple to adopt, but it is an unreliable indication of the true 
capital needs of a firm because it uses only revenue as a driver. For example, if two firms had 
the same annual revenue over the last three years, but widely different risk controls, their 
capital requirements would be the same. Note also that operational risk capital requirements 
can be greatly affected by a single years extraordinary revenue when risk at the firm has not 
materially changed. 

The Standardized Approach 

For the standardized approach (TSA), the bank uses eight business lines with different beta 
factors to calculate the capital charge. With this approach, the beta factor of each business 
line is multiplied by the annual gross income amount over a three-year period. The results 
are then summed to arrive at the total operational risk capital charge under the standardized 
approach. The beta factors used in this approach are shown as follows: 

• Investment banking (corporate finance): 18%. 

• Investment banking (trading and sales): 18%. 

• Retail banking: 12%. 

• Commercial banking: 15%. 

• Settlement and payment services: 18%. 

• Agency and custody services: 15%. 

• Asset management: 12%. 

• Retail brokerage: 12%. 

The standardized approach attempts to capture operational risk factors not covered by the 
BIA by assuming that different business activities carry different levels of operational risk. 
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Any negative capital charges from business lines can be offset up to a maximum of zero 
capital. The capital requirement, under this approach is computed as follows: 


Kjsa 


max[^(GIi_8x3i_8),0] 

3 Years 


3 


where: 

Gl^ g = annual gross income in a given year for each of the eight business lines 
|3i 8 = beta factors (fixed percentages for each business line) 

In the following examples, Gamma Bank has only three lines of business and uses the 
standardized approach for its operational risk capital calculation. 


Example 1: Calculating TSA capital charge 

Assume Gamma Bank has the following revenue (in $100 millions) for the past three 
years for its three lines of business: trading and sales, commercial banking, and asset 
management. 


Business Line 

Year 1 

Year 2 

Year 3 

Trading and Sales 

10 

15 

20 

Commercial Banking 

5 

10 

15 

Asset Management 

10 

10 

10 


Calculate the operational risk capital requirement under TSA. 


Answer: 


To calculate TSA capital charge, we first incorporate the relevant beta factors as follows: 


Business Line 

Year 1 

Year 2 

Year 3 

Trading and Sales 

10 X 18%= 1.8 

15 X 18% = 2.7 

20 X 18% = 3.6 

Commercial Banking 

5 X 15% = 0.75 

10 X 15%= 1.5 

15 X 15% = 2.25 

Asset Management 

10 X 12%= 1.2 

10 X 12%= 1.2 

10 X 12% = 1.2 

Total 

3.75 

5.4 

7.05 


Next, enter these totals into the capital charge calculation as follows: 

,, (3.75 + 5.4 + 7.05) , 

^TSA =-;-= 


Thus, Gamma Bank must hold $540 million in operational risk capital under Basel II 
using the standardized approach. 
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Example 2: Calculating TSA capital charge 

If Delta Bank has negative revenue in any business line, it can offset capital charges that 
year up to a maximum benefit of zero capital. Beta Bank has had the following revenue (in 
$100 millions) for the past three years for its two lines of business: corporate finance and 
retail banking. 


Business Line 

Year 1 

Year 2 

Year 3 

Corporate Finance 

5 

10 

15 

Retail Banking 

5 

-25 

5 

Calculate the operational risk capital requirement under TSA. 


Answer: 




Business Line 

Year 1 

Year 2 

Year 3 

Corporate Finance 

5x 18% = 0.90 

10 X 18%= 1.80 

15 X 18% = 2.7 

Retail Banking 

5 X 12% = 0.60 

-25 X 12% = -3.0 

5 X 12% = 0.60 

Total 

1.5 

-1.2 

3.3 


Because a negative number cannot be used in the numerator, we replace -1.2 in Year 2 
with zero. However, unlike the BIA, the number of years remains at three. Entering these 
totals into the capital charge calculation yields: 


Ktsa — 


(1.5+ 0 + 3.3) 


1.6 


Thus, Delta Bank would hold $160 million operational risk capital under Basel II using 
the standardized approach. 


Alternative Standardized Approach 

Under Basel II, a bank can be permitted to use the alternative standardized approach (ASA) 
provided it can demonstrate an ability to minimize double counting of certain risks. The 
ASA is identical to the standardized approach except for the calculation methodologies in 
the retail and commercial banking business lines. For these business lines, gross income 
is replaced with loans and advances times a multiplier, which is set equal to 0.035. Under 
the ASA, the beta factor for both retail and commercial banking is set to 15%. The capital 
requirement for the retail banking business line, Kp^, (which is the same for commercial 
banking) is computed as follows: 

^RB ^ ^ ^RB ^ ^ 

where: 

(3rb = beta factor for retail banking business line (15%) 

LArb = average total outstanding retail loans and advances over the past three years 
m = multiplier (0.035) 
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Unanticipated Results from Negative Gross Income 

The BIA and TSA capital charge methodologies can produce inappropriate results when 
accounting for negative gross income. For example, consider the following gross income 
amounts multiplied by the corresponding beta factors (in $100 millions): 


Business Line 

Year 1 

Year 2 

Year 3 

Corporate Finance 

5 X 18% = 0.9 

10 X 18%= 1.8 

-15 X 18% = -2.7 

Retail Banking 

5 X 12% = 0.6 

-25 X 12% = -3 

5 X 12% = 0.6 

Total 

1.5 

-1.2 

-2.1 


Under this scenario, the standardized approach will compute a capital charge of $50 million 
as follows: 


^ _( 1.5 + 0 + 0 ) 

^TSA --- 


0.5 


However, recall that the BIA applies a fixed 15% of gross income and reduces the value 
of n when negative gross income is present. Thus, under the same scenario, the BIA will 
compute a capital charge of $150 million as follows: 


^BIA - 


[(5 + 5)x0.15] _^^ 
1 


Therefore, this bank would hold only $50 million in operational risk capital using TSA 
but $150 million under the BIA. The Basel Committee has recognized that capital under 
Pillar 1 (minimum capital requirements) may be distorted and, therefore, recommends 
that additional capital should be added under Pillar 2 (supervisory review) if negative gross 
income leads to unanticipated results. 


Advanced Measurement Approach 


LO 43.2: Describe the modeling requirements for a bank to use the Advanced 
Measurement Approach (AMA). 


The advanced measurement approach (AJMA) allows banks to construct their own models 
for calculating operational risk capital. Although the Basel Committee allows significant 
flexibility in the use of the AMA, there are three main requirements. A bank must: 

• Demonstrate an ability to capture potentially severe “fat-tail” losses (banks must use 
99.9th percentile events with a one-year time horizon). 

• Include internal loss data, external loss data, scenario analysis, and business environment 
internal control factors (i.e., the four data elements). 

• Allocate capital in a way that incentivizes good behavior (i.e., create incentives to 
improve business line operational risk management). 

Under the AMA, capital requirements should be made for all seven risk categories specified 
by Basel II. Some firms calculate operational risk capital at the firm level and then allocate 
down to the business lines, while others calculate capital at the business line level. Capital 


Page 78 


©2018 Kaplan, Inc. 










Topic 43 

Cross Reference to GARP Assigned Reading - Girling, Chapter 12 

calculations are typically performed by constructing a business line/event type matrix, where 
capital is allocated based on loss data for each matrix cell. 

Additional quantitative requirements under the AMA include: 

• The approach must capture all expected and unexpected losses and may only exclude 
expected losses under certain criteria as stated in Basel II. 

• The approach must provide sufficient detail to ensure that fat-tail events are captured. 

• The bank must sum all calculated cells in the business line/event type matrix and be able 
to defend any correlation assumptions made in its AMA model. 

• All four data elements must be included in the model, including the use of internal and 
external data, scenario analysis, and business environment factors. 

• The bank must use appropriate weights for the four data elements when determining 
operational risk capital. 

While the four data elements must be considered in the capital calculations, many banks 
use some of these elements only to allocate capital or perform stress tests, and then adjust 
their models, rather than using them as direct inputs into capital calculations. Regulators 
have accepted many different types of AMA models, such as the loss distribution approach, 
given the rapid development of modeling operational risk capital. 


Loss Distribution Approach 


LO 43.3: Describe the loss distribution approach to modeling operational risk 
capital. 


The loss distribution approach (LDA) relies on internal losses as the basis of its design. 

A simple LDA model uses internal losses as direct inputs with the remaining three data 
elements being used for stressing or allocation purposes. However, according to Basel II, a 
bank must have at least five years of internal loss data regardless of its model design but can 
use three years of data when it first moves to the AMA. 

The advantage of the LDA is that it is based on historical data relevant to the firm. The 
disadvantage is that the data collection period is likely to be relatively short and may not 
capture fat-tail events. For example, no firm can produce 1,000 years of data, but the 
model is supposed to provide a 99.9% confidence level. Also, some firms find that they 
have insufficient loss data to build a model, even if they have more than five years of data. 
Additionally, banks need to keep in mind that historical data is not necessarily reflective of 
the future because firms change products, processes, and controls over time. 


LO 43.4: Explain how frequency and severity distributions of operational losses 
are obtained, including commonly used distributions and suitability guidelines for 
probability distributions. 


Modeling Frequency 

When developing a model of expected operational risk losses, the first step is to determine 
the likely frequency of events on an annual basis. The most common distribution for 
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modeling frequency is the Poisson distribution. This distribution uses only one parameter, 
X, which represents the average number of events in a given year, as well as the distributions 
mean and variance. In an LDA model, X can be obtained by observing the historical 
number of internal loss events per year and then calculating the average. 

The Poisson distribution represents the probability of a certain number of events occurring 
in a single year. As shown in Figure 2, lower values of X produce more skewed and 
leptokurtic annual loss distributions than higher values of X. 


Figure 2: Comparing Poisson Distributions 



Modeling Severity 


The next step in modeling expected operational risk losses is to determine the likely size 
(i.e., severity) of an event. The most common and least complex approach is to use a 
lognormal distribution. However, low frequency losses may be a better fit to distributions 
such as Generalized Gamma, Transformed Beta, Generalized Pareto, or Weibull. Regulators 
are interested in the selected distributions “goodness of fit.” 

Regardless of the distribution selected, the probability density function must exhibit fat 
tails. Events that are more than three standard deviations from the mean are more likely 
to occur than in a normal distribution; thus, the distribution will be skewed as seen in 
Figure 3. 
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Monte Carlo Simulation 


LO 43.5: Explain how Monte Carlo simulation can be used to generate additional 
data points to estimate the 99.9^^ percentile of an operational loss distribution. 


Once the frequency and severity distributions have been established, the next step is to 
combine them to generate data points that better estimate the capital required. This is done 
to ensure that likely losses for the next year will be covered at the 99.9% confidence level. 
Monte Carlo simulation can be used to combine frequency and severity distributions (a 
process known as convolution) in order to produce additional data points with the same 
characteristics as the observed data points. 

With this process, we make random draws from the loss frequency data and then draw those 
events from the loss severity data. Each combination of frequency and severity becomes 
a potential loss event in our loss distribution. This process is continued several thousand 
times to create the potential loss distribution. To find the 99.9% confidence level, with a 
million observations for example, we would select the 1,000th item in an ordered list (from 
largest to smallest loss) to represent the maximum loss that will be experienced in a single 
year with 99.9% certainty. 


Scenario Analysis 


LO 43.6: Explain the use of scenario analysis and the hybrid approach in modeling 
operational risk capital. 


Scenario analysis data is designed to identify fat-tail events, which is useful when 
calculating the appropriate amount of operational risk capital. The advantage of using 
scenario analysis is that data reflects the future through a process designed to consider “what 
if” scenarios, in contrast to the LDA which only considers the past. The major disadvantage 
of scenario analysis is that the data is highly subjective, and it only produces a few data 
points. As a result, complex techniques must be applied to model the full loss distribution. 
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as the lack of data output in scenario analysis can make the fitting of distributions difficult. 
In addition, small changes in assumptions can lead to widely different results. 

There are many different approaches to scenario analysis, but whichever method is used, 
a scarcity of data points is likely. This makes pure scenario analysis a difficult approach to 
defend in estimating risk capital. Also, the more reliance there is on scenario analysis, the 
more robust the program must be because sometimes there is little or no loss data available 
and a model may need to rely purely on scenario analysis for a particular risk category. 
Consequently, it is acceptable to have different modeling techniques for various risk 
categories as long as the differences are justified. While some scenario-based models have 
been approved in Europe, U.S. regulators generally do not accept them. 

In the hybrid approach, loss data and scenario analysis output are both used to calculate 
operational risk capital. Some firms combine the LDA and scenario analysis by stitching 
together two distributions. For example, the LDA may be used to model expected losses, 
and scenario analysis may be used to model unexpected losses. Another approach combines 
scenario analysis data points with actual loss data when developing frequency and severity 
distributions. 

Insurance 

Banks have the option to insure against the occurrence of operational risks. The important 
considerations are how much insurance to buy and which operational risks to insure. 
Insurance companies offer polices on everything from losses related to fire to losses 
related to a rogue trader. A bank using the AMA for calculating operational risk capital 
requirements can use insurance to reduce its capital charge. However, the recognition of 
insurance mitigation is limited to 20% of the total operational risk capital required. 

The LDA allows for a risk profiling of an institution, which can include the risk reducing 
effect of insurance, which then alters the aggregate loss distribution. Typically this is done 
by reducing the severity of the losses that exceed a given deductible in the insurance policy. 
In other words, insurance typically lowers the severity but not the frequency. 

Operational risk capital may need to be billions of dollars, so it can be worthwhile to 
pursue insurance as a means to reduce the amount of capital needed. Insurance companies 
are attempting to accommodate industry needs through new insurance products that meet 
Basel requirements. 
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Key Concepts 


L0 43.1 

The three methods for calculating operational risk capital requirements are (1) the basic 
indicator approach (BIA), (2) the standardized approach (TSA), and (3) the advanced 
measurement approach (AMA). Large banks are encouraged to move from TSA to the AMA 
in an effort to reduce capital requirements. 


LO 43.2 

The first requirement to use the AMA is that the model must hold sufficient capital to cover 
all operational risk losses for one year with a certainty of 99.9%. The second requirement 
is that internal loss data, external loss data, scenario analysis, and business environment 
internal control factors must be included in the model. The third requirement is that there 
must be a method for allocating capital that incentivizes good behavior. 


LO 43.3 

The loss distribution approach (LDA) relies on internal losses as the basis of its design. 

It uses internal losses as direct inputs, with the remaining data elements being used for 
stressing or allocation purposes. However, regardless of its model design, a bank must have 
at least three years of loss data. The advantage of the LDA model is that it is based on 
historical data relevant to the firm. The disadvantage is that the data collection period is 
likely to be relatively short and may not capture all fat-tail events. 


LO 43.4 

When developing a model of expected operational risk losses, the first step is to determine 
the likely frequency of events on an annual basis. The most popular distribution for 
modeling frequency is the Poisson distribution. In a Poisson distribution, there is only one 
parameter, X, which represents the average number of events in a given year. The next step 
in modeling expected operational risk losses is to determine the severity of an event. The 
most common and least complex distribution is to use a lognormal distribution. 


LO 43.5 

Once the frequency and severity distributions have been established, the next step is 
to use them to generate data points to better estimate the capital required at a 99.9% 
confidence level. Monte Carlo simulation is a method for combining frequency and 
severity distributions to produce additional data points that have the same characteristics as 
observed data points. 


LO 43.6 

Scenario analysis data is designed to identify fat-tail events and is useful in calculating 
the appropriate amount of operational risk capital. In the hybrid approach, loss data and 
scenario analysis output are both used to calculate operational risk capital. 
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Concept Checkers 


1. Under the basic indicator approach (BIA), what is Alpha Banks capital charge if 
it has revenues of $100 million, $150 million, and $200 million in the first three 
years? 

A. $22.0 million. 

B. $22.5 million. 

C. $23.0 million. 

D. $23.5 million. 

2. Which of the following statements is not a requirement to apply the advanced 
measurement approach (AMA)? 

A. The model must hold capital to cover all operational risk losses for one year with 
a certainty of 99.9%. 

B. Internal loss data, external loss data, scenario analysis, and business environment 
internal control factors must be included in the model. 

C. Capital must be allocated to minimize risk. 

D. There must be a method for allocating capital that incentivizes good behavior. 

3. Which of the following reasons is not a disadvantage of the loss distribution 
approach (LDA) to modeling operational risk capital requirements? 

A. The LDA is based on historical data. 

B. Most firms have limited historical data. 

C. Fat-tail events may not be captured by modeling. 

D. Historical data is not reflective of the future. 

4. When modeling risk frequency, it is common to: 

A. use a Poisson distribution. 

B. assume that risks are highly correlated. 

C. assume risk frequency and severity are the same. 

D. use a straight-line projection from the most recent loss data. 

5. Extreme losses in the tail of the operational risk loss distribution most likely follow 
which type of process/distribution? 

A. Generalized Pareto distribution. 

B. Historical simulation method. 

C. Poisson distribution. 

D. Extreme value theory. 
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Concept Checker Answers 


1. B The BIA is based on 15% of the banks annual gross income over a three-year period and is 

computed as follows: 

^^_^^IaO0 + 150+M^H5l,j22.5 million 
3 

2. C There is no specific requirement under the AMA to minimize risk. 

3. A An advantage of the LDA model is that it is based on historical data relevant to the firm. 

4. A It is common to use a Poisson distribution to model loss frequency. A Poisson distribution 

has a single parameter, X, which can be varied to accurately describe loss data. 

5. A The most common and least complex approach for modeling extreme losses is to use a 

lognormal distribution. However, low frequency losses may be a better fit to distributions 
such as Generalized Gamma, Transformed Beta, Generalized Pareto, or Weibull. 
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The following is a review of the Operational and Integrated Risk Management principles designed to address 
the learning ohjectives set forth hy GARP®. This topic is also covered in: 


Standardized Measurement 
Approach for Operational Risk 


Topic 44 

Exam Focus 

The focus of this topic is on the calculation of the standardized measurement approach 
(SMA). In particular, candidates should understand how the business indicator (BI) is 
derived and how buckets are used to group banks by size such that the BI will have a 
different impact on the SMA given a banks bucket. Candidates should also know how to 
calculate the internal loss multiplier and the loss component, along with understanding how 
this component impacts the SMA given a banks bucket classification. The SMA has evolved 
over time from earlier approaches that were more model-based and allowed too much 
flexibility. Candidates should also be familiar with the Basel Committee s outline of general 
and specific criteria applicable to operational loss data. 


The Standardized Measurement Approach 


LO 44.1: Explain the elements of the proposed Standardized Measurement 
Approach (SMA), including the business indicator, internal loss multiplier and loss 
component, and calculate the operational risk capital requirement for a bank using 
the SMA. 


The standardized measurement approach (SMA) represents the combination of a 
financial statement operational risk exposure proxy (termed the business indicator, or BI) 
and operational loss data specific for an individual bank. Because using only a financial 
statement proxy such as the BI would not fully account for the often significant differences 
in risk profiles between medium to large banks, the historical loss component was added to 
the SMA to account for future operational risk loss exposure. As such, the loss component 
serves to both enhance the SMAs sensitivity to risk and to offer an incentive for a bank to 
improve on its operational risk management practices. A bank will be required to hold less 
in operational risk regulatory capital with fewer operational risk losses and a more effective 
risk management system. 

The Business Indicator 

The business indicator (BI) incorporates most of the same income statement components 
that are found in the calculation of gross income (GI). A few differences include: 

• Positive values are used in the BI (versus some components incorporating negative values 
into the GI). 

• The BI includes some items that tie to operational risk but are netted or omitted from 
the GI calculation. 
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The SMA calculation has evolved over time, as there were several issues with the first 

calculation that were since remedied with the latest version. These items include: 

• Modifying the service component to equal max(fee income, fee expense) + max(other 
operating income, other operating expense). This change still allowed banks with 
large service business volumes to be treated differently from banks with small service 
businesses, while also reducing the inherent penalty applied to banks with both high fee 
income and high fee expenses. 

• Including dividend income in the interest component, which alleviated the differing 
treatment among institutions as to where dividend income is accounted for on their 
income statements. 

• Adjusting the interest component by the ratio of the net interest margin (NIM) cap (set 
at 3.5%) to the actual NIM. Before this adjustment, banks with high NIMs (calculated 
as net interest income divided by interest-earning assets) were penalized with high 
regulatory capital requirements relative to their true operational risk levels. 

• For banks with high fee components (those with shares of fees in excess of 50% of 
the unadjusted BI), modifying the BI such that only 10% of the fees in excess of the 
unadjusted BI are counted. 

• Netting and incorporating all financial and operating lease income and expenses into the 
interest component as an absolute value to alleviate inconsistent treatment of leases. 

Business Indicator Calculation 

The BI is calculated as the most recent three-year average for each of the following three 

components: 


BI = ILDC^^^ + SC_ + FC_ 

avg avg avg 

where: 

ILDC = interest, lease, dividend component 
SC = services component 

FC = financial component 

The three individual components are calculated as follows, using three years of average data: 


interest, lease, dividend component (ILDC) = 

min[abs(II - IE J, 0.035 x lEA^ J + abs(LI_ - LE_) + DI 

avg avg' ’ avg-* avg avg' avg 

where: 

abs = absolute value 

II = interest income (excluding operating and finance leases) 

IE = interest expenses (excluding operating and finance leases) 
lEA = interest-earning assets 
LI = lease income 
LE = lease expenses 
DI = dividend income 
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services component (SC) = 

max(OOI^^g, OOE^^g) + max{abs(FI^^g - FE^^g), min[max(FI^^g, FE^^^), 0.5 x uBI + 
0.1 X (max(FI^^g, FE^^^) - 0.5 x uBI)]} 
where: 

OOI = other operating income 

OOE = other operating expenses 

FI = fee income 

FE = fee expenses 

uBI = unadjusted business indicator = 

ILDC + max(OOI , OOE ) + max(FI , FE ) + FC 

avg avg’ avg' avg’ avg' avg 


financial component (FC) = 

abs(net P&LTB^^.g) + abs(net P&LBB^..^) 

where: 

P&L = profit & loss statement line item 
TB = trading book 
BB = banking book 

For the purposes of calculating the SMA, banks (based on their size for the BI component) 
are divided into five buckets as shown in Figure 1. 


Figure 1: BI Buckets 


Bucket 

BI Range 

BI Component 

1 

€0 billion-€l billion 

0.11 X BI 

2 

€1 billion-€3 billion 

€110 million + 0.15(BI-€1 billion) 

3 

€3 billion-€10 billion 

€410 million + 0.19(BI -€3 billion) 

4 

€10 billion-€30 billion 

€1.74 billion + 0.23 (BI - €10 billion) 

5 

€30 billion - +oo 

€6.34 billion + 0.29(BI - €30 billion) 


While a banks internal losses are not factored in for the bucket 1 group, internal losses 
are factored in for banks in buckets 2—5 to the extent that they allow for differentiation 
among banks with different risk profiles. As is evident from Figure 1, there is both a linear 
increase in the BI component within a given bucket and an increase in the marginal impact 
(i.e., 0.11 for bucket 1, 0.15 for bucket 2, etc.) of the BI for banks in higher versus lower 
buckets. 

The BI component calculation should exclude all of the following P&L items: 
administrative expenses, recovery of administrative expenses, impairments and impairment 
reversals, provisions and reversals of provisions (unless they relate to operational loss events), 
fixed asset and premises expenses (unless they relate to operational loss events), depreciation 
and amortization of assets (unless it relates to operating lease assets), expenses tied to share 
capital repayable on demand, income/expenses from insurance or reinsurance businesses, 
premiums paid and reimbursements/payments received from insurance or reinsurance 
policies, goodwill changes, and corporate income tax. 
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Internal Loss Multiplier Calculation 

Through the addition of a loss component, the SMA becomes more sensitive to risk 
than it would be with just the BI component alone. As highlighted above, internal losses 
become a relevant factor for banks in buckets 2—5. Internal losses are factored into the SMA 
calculation via the internal loss multiplier, which is calculated as follows: 


internal loss multiplier = In 


e>-l 


loss component 
BI component 


where: 

loss component = 

7 X average total annual loss 

+ 7 X average total annual loss only including loss events above €10 million 
+ 5 X average total annual loss only including loss events above €100 million 

The loss component serves to reflect the operational loss exposure based on a banks 
internal loss experiences. To differentiate between banks with similar average loss totals but 
differing loss distributions, the loss component distinguishes between smaller loss events 
versus those above €10 million and €100 million. The logarithmic function contained 
within the internal loss multiplier suggests that it increases at a decreasing rate (with the loss 
component) and has a lower bound equal to: [ln(e^ — 1) = 0.541]. 

Ideally, a bank will have 10 years of quality data to calculate the averages that go into the 
loss component calculation. If 10 years are not available, then during the transition to 
the SMA calculation, banks may use 5 years and add more years as time progresses until 
they reach the 10-year requirement. If a bank does not have 5 years of data, then the BI 
component becomes the only component of the SMA calculation. 

A bank whose exposure is considered average relative to its industry will have a loss 
component equivalent to its BI component; this implies an internal loss multiplier equal to 
one and an SMA capital requirement equal to its BI component. If a banks loss experience 
is greater (less) than the industry average, its loss component will be above (below) the BI 
component and its SMA capital will be above (below) the BI component. 

SMA Capital Requirement Calculation 

The SMA is used to determine the operational risk capital requirement and is calculated as 
follows: 

For BI bucket 1 banks: 

SMA capital = BI component 
For BI bucket 2-5 banks: 

SMA capital = 1 lOM + (BI component - 1 lOM) x internal loss multiplier 
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The amounts used in the BI component, which are bucket-dependent, will follow the 
equations shown in the BI component column of Figure 1. The internal loss multiplier is 
calculated per the previous section. 

For banks that are part of a consolidated entity, the SMA calculations will incorporate 
fully consolidated BI amounts (netting all intragroup income and expenses). At a 
subconsolidated level, the SMA uses BI amounts for the banks that are consolidated at 
that particular level. At the subsidiary level, the SMA calculations will use the BI amounts 
from the specific subsidiary. If the BI amounts for a subsidiary or subconsolidated level 
reach the bucket 2 level, the banks must incorporate their own loss experiences (not 
those of other members of the group). If a subsidiary of a bank in buckets 2—5 does not 
meet the qualitative standards associated with using the loss component, the SMA capital 
requirement is calculated using 100% of the BI component. 

It is possible that the Committee will consider an alternative to the calculation of the 
internal loss multiplier shown earlier, which would replace the logarithmic function with 
a maximum multiple for the loss component. The formula for the internal loss multiplier 
would then be updated as: 


m X LC + (m — 1) X BIG 
^ LC + (2m-2)xBIC , 

where: 

m = factor to be calibrated 

LC = loss component 

BIC = business indicator component 


Example: Computing the SMA Capital Requirement 

PS Bank Inc., has a BI of €18.48 million for the current fiscal year. Calculate PS Banks 
capital requirement with the standardized measurement approach. 

Answer: 

PS Bank is a bucket 1 bank because its BI falls within the range of €0 billion-€l billion. 
For bucket 1 banks, the only component of the SMA calculation is the BI component and 
the calculation is: 0.11 x €18.48 million, or €2.03 million. 


SMA vs. Earlier Operational Risk Capital Approaches 


LO 44.2: Compare the SMA to earlier methods of calculating operational risk 
capital, including the Alternative Measurement Approaches (AMA), and explain 
the rationale for the proposal to replace them. 


Before the development of the SMA, banks were using either the advanced measurement 
approach (AMA), the standardized approach (TSA), or its variation, the alternative 
standardized approach (ASA), to assess operational risk. The advanced measurement 
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approach, which was introduced as part of the Basel II framework in 2006, allowed for 
the estimation of regulatory capital based on a range of internal modeling practices. This 
approach was a principles-based framework allowing for significant flexibility. Although the 
hope of the Basel Committee was for best practices to emerge as flexibility declined, this 
never happened and challenges associated with comparability among banks (due to a wide 
range of modeling practices) and overly complex calculations remained. 

Given these challenges, the Basel Committee set a goal of creating a new measure to allow 
for greater comparability and less complexity relative to prior methods. The SMA was 
created as this measure, with the intent of providing a means of assessing operational risk 
that would include both a standardized measure of operational risk and bank-specific 
loss data. Unlike AMA, the SMA is a single, non-model-based method used to estimate 
operational risk capital that combines financial statement information with the internal 
loss experience of a specific bank. The SMA is to be applied to internationally active banks 
on a consolidated basis, whereas it is optional for non-internationally active institutions. 

Although it is a relatively new measure, the SMA combines key elements of the standardized 
approach along with an internal loss experience component that was central to older 
approaches. 


Identification, Collection, and Treatment of Operational Loss Data 


LO 44.3: Describe general and specific criteria recommended by the Basel 
Committee for the identification, collection, and treatment of operational loss data. 


Banks that incorporate the loss component into the SMA calculation must follow the 

following general criteria: 

• Documented processes and procedures must be in place for the identification, collection, 
and treatment of internal loss data. 

• A bank must maintain information on each operational risk event, including gross loss 
amounts, the date of occurrence (when the event first began or happened), the date of 
discovery (when the bank became aware of the event), the date of accounting (when the 
reserve, loss, or loss provision was first recognized in the banks income statement, any 
gross loss amount recoveries, and what the drivers were of the loss event itself). 

• Specific criteria must exist for loss data assignments stemming from centralized function 
events and related events over time (considered grouped losses). 

• For the purposes of calculating minimum regulatory capital per the SMA framework, 
operational risk losses tied to credit risk will be excluded from the calculation. 
Operational risk losses tied to market risk will be included in the SMA calculation. 

• A bank has to be able to document any criteria used to allocate losses to specific event 
types. In addition, a bank must be able to categorize historical internal loss data into 
the appropriate Level 1 supervisory categories per the Basel II Accord (Annex 9) and be 
prepared to provide this to supervisors when requested. 

• An observation period of 10 years must be used as a basis for internally generated loss 
data calculations. On an exception basis and as long as good-quality data is not available 
for more than a five-year period, a bank first moving to the SMA can use a five-year 
observation period. 

• Internal loss data must be comprehensive in nature and capture all material exposures 
and activities across all geographic locations and subsystems. When a bank first moves 
to the SMA, a €20,000 de minimis gross loss threshold is acceptable. Afterward, this 
threshold is lowered to €10,000. 
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In addition to the general criteria noted previously, specific criteria must also be followed as 
described as follows: 

• A policy must exist for each bank that sets the criteria for when an operational risk event 
or loss (which is recorded in the internal loss event database) is included in the loss data 
set for calculating the SMA regulatory capital amount (i.e., the SMA loss data set). 

• For all operational loss events, banks must be able to specifically identify gross loss 
amounts, insurance recoveries, and non-insurance recoveries. A gross loss is a loss before 
any recoveries, while a net loss takes into account the impact of recoveries. The SMA loss 
data cannot include losses net of insurance recoveries. 

• In calculating the gross loss for the SMA loss data set, the following components must 
be included: 

♦ External expenses (legal fees, advisor fees, vendor costs, etc.) directly tied to the 
operational risk event itself and any repair/replacement costs needed to restore the 
bank to the position it was in before the event occurring. 

♦ Settlements, impairments, write-downs, and any other direct charges to the banks 
income statement as a result of the operational risk event. 

♦ Any reserves or provisions tied to the potential operational loss impact and booked 
to the income statement. 

♦ Losses (tied to operational risk events) that are definitive in terms of financial impact 
but remain as pending losses because they are in transition or suspense accounts 
not reflected on the income statement. Materiality will dictate whether the loss is 
included in the data set. 

♦ Timing losses booked in the current financial accounting period that are material 
in nature and are due to events that give rise to legal risk and cross more than one 
financial accounting period. 

• In calculating the gross loss for the SMA loss data set, the following components must be 
excluded: 

♦ The total cost of improvements, upgrades, and risk assessment enhancements and 
initiatives that are incurred after the risk event occurs. 

♦ Insurance premiums. 

♦ The costs associated with general maintenance contracts on property, plant, and 
equipment (PP&E). 

• For every reporting year of the SMA regulatory capital, the gross losses included in the 
loss data set must incorporate any financial adjustments (additional losses, settlements, 
provision changes) made within the year for risk events with reference dates up to 10 
years before that reporting year. The operational loss amount after adjustments must 
then be identified and compared to the €10 million and €100 million threshold. 

• The only two dates a bank can use to build its SMA loss data set are the date of discovery 
or the date of accounting. For any legal loss events, the date of accounting (which is 
when the legal reserve representing the probable estimated loss) is the latest date that can 
be used for the loss data set. 

• Any losses that are related to a common operational risk event or are related by 
operational risk events over time are considered grouped losses and must be entered as a 
single loss into the SMA loss data set. 

• The circumstances, data types, and methodology for grouping data should be defined 
with criteria found in the individual banks internal loss data policy. In instances 
where individual judgment is needed to apply the criteria, this must be clarified and 
documented. 
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Key Concepts 


L0 44.1 

The standardized measurement approach (SMA) includes both a business indicator (BI) 
component accounting for operational risk exposure and an internal loss multiplier and loss 
component accounting for operational losses unique to an individual bank. While the BI 
component is factored into the SMA for banks of all sizes, the impact it has on the SMA 
calculation will vary depending on where the bank is classified from buckets 1—5. The loss 
component is factored in for all banks classified in buckets 2—5. 


LO 44.2 

The older advanced measurement approach (AMA) allowed banks to use a vast range of 
models that were inherently more flexible for individual banks but prevented valuable 
comparisons among banks. From this, the SMA was created as a non-model-based approach 
used to assess operational risk using both financial statement measures and loss data unique 
to individual banks. 


L0 44.3 

For identifying, collecting, and accounting for operational loss data, the Basel Committee 
has outlined several general and specific criteria that should be used. Key general criteria 
include processes and procedures, documentation needed, thresholds for capturing losses, 
and appropriate periods. Specific criteria include how to calculate gross losses (what is 
included versus what is excluded), key dates used to capture the losses, how to quantify 
grouped losses, and policies needed. 
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Concept Checkers 


1. The business indicator (BI) component in the standardized measurement approach 
(SMA) calculation for a bank with a BI of €13 billion will be closest to: 

A. €1.43 billion. 

B. €1.91 billion. 

C. €2.43 billion. 

D. €13.00 billion. 

2. Which of the following items from the profit & loss (P&L) statement should be 
included in the BI component calculation? 

A. Administrative expenses. 

B. Insurance premiums paid. 

C. Depreciation related to capitalized equipment. 

D. Provision reversals related to operational loss events. 

3. Which of the following components within the BI calculation takes into account a 
banks trading and banking book P&L results? 

A. Loss component. 

B. Services component. 

C. Financial component. 

D. Interest, lease, dividend component. 

4. Which of the following statements best describes a difference between the SMA and 
the older operational risk capital approaches? 

A. The standardized approach (TSA) and the alternative standardized approach 
(ASA) were variations of the SMA. 

B. The advanced measurement approach (AMA) was more flexible in its 
application than the SMA. 

C. The SMA accounts for internal loss experiences that were not factored into the 
AMA. 

D. The SMA uses a model-based methodology, while the AMA was more flexible 
and principles-based. 

5. In deriving the SMA loss data set for an individual bank, each of the following items 
will most likely be included in the gross loss calculation except: 

A. legal fees of €900,000 associated with an unusual risk event. 

B. a €2 million settlement tied to a recent operational risk event. 

C. a €1.4 million reserve booked to the income statement to cover a potential 
operational loss. 

D. €1.75 million spent on maintenance contracts tied to the banks property, plant, 
and equipment (PP&E). 
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Concept Checker Answers 


1. C A bank with a BI of €13 million will fall into bucket 4, which covers a BI range of €10 

billion to €30 billion. With the BI component formula of €1.74 billion + 0.23(BI - €10 
billion) for bucket 4 banks, the BI component for this bank will be equal to €1.74 billion + 
0.23(€13 billion - €10 billion) = €2.43 billion. 

2. D A provision reversal would normally be excluded except when it relates to operational loss 

events. Each of the other three choices represents a P&L item that should be excluded from 
the BI component calculation. 

3. C The formula for the financial component of the BI calculation is equal to: 

abs(net P&LTB^^^.g) + abs(net P&LBBj^^^ 
with TB representing the trading book and BB representing the banking book. 

4. B Because banks were able to use a wide range of models for calculating the AMA, there was 

more flexibility to these approaches than under the new SMA. TSA and ASA were older 
approaches rather than variations of the SMA. AMA did account for internal losses. The 
SMA is non-model-based, whereas the AMA did incorporate bank-specific models. 

5. D The costs associated with maintenance contracts for PP&E are outlined in the specific 

criteria for collecting operational loss data as excluded for the purposes of calculating the gross 
loss for the SMIA loss data set. 
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Parametric Approaches (II): 
Extreme Value 


Topic 45 

Exam Focus 

Extreme values are important for risk management because they are associated with 
catastrophic events such as the failure of large institutions and market crashes. Since they are 
rare, modeling such events is a challenging task. In this topic, we will address the generalized 
extreme value (GEV) distribution, and the peaks-over-threshold approach, as well as discuss 
how peaks-over-threshold converges to the generalized Pareto distribution. 


Managing Extreme Values 


LO 45.1: Explain the importance and challenges of extreme values in risk 
management. 


The occurrence of extreme events is rare; however, it is crucial to identify these extreme 
events for risk management since they can prove to be very costly. Extreme values are the 
result of large market declines or crashes, the failure of major institutions, the outbreak 
of financial or political crises, or natural catastrophes. The challenge of analyzing and 
modeling extreme values is that there are only a few observations for which to build a 
model, and there are ranges of extreme values that have yet to occur. 

To meet the challenge, researchers must assume a certain distribution. The assumed 
distribution will probably not be identical to the true distribution; therefore, some degree of 
error will be present. Researchers usually choose distributions based on measures of central 
tendency, which misses the issue of trying to incorporate extreme values. Researchers need 
approaches that specifically deal with extreme value estimation. Incidentally, researchers in 
many fields other than finance face similar problems. In flood control, for example, analysts 
have to model the highest possible flood line when building a dam, and this estimation 
would most likely require a height above observed levels of flooding to date. 

Extreme Value Theory 


LO 45.2: Describe extreme value theory (EVT) and its use in risk management. 


Extreme value theory (EVT) is a branch of applied statistics that has been developed to 
address problems associated with extreme outcomes. EVT focuses on the unique aspects of 
extreme values and is different from “central tendency” statistics, in which the central-limit 
theorem plays an important role. Extreme value theorems provide a template for estimating 
the parameters used to describe extreme movements. 
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One approach for estimating parameters is the Fisher—Tippett theorem (1928). According 
to this theorem, as the sample size n gets large, the distribution of extremes, denoted M^, 
converges to the following distribution known as the generalized extreme value (GEV) 
distribution: 


if 


F(X|^,H,a) = exp 

_ 

X — 

1 + ^x —^ 

-i/t 



CT J 



F(X I = exp 


-exp 


X —[1 


if ^ = 0 


For these formulas, the following restriction holds for random variable X\ 

X — 


1 + ^X- 


>0 


The parameters [i and cr are the location parameter and scale parameter, respectively, of 
the limiting distribution. Although related to the mean and variance, they are not the 
same. The symbol ^ is the tail index and indicates the shape (or heaviness) of the tail of the 
limiting distribution. There are three general cases of the GEV distribution: 

1. ^ > 0, the GEV becomes a Frechet distribution, and the tails are “heavy” as is the 

case for the ^-distribution and Pareto distributions. 


2. ^ = 0, the GEV becomes the Gumbel distribution, and the tails are “light” as is the 
case for the normal and log-normal distributions. 

3. ^ < 0, the GEV becomes the Weibull distribution, and the tails are “lighter” than a 
normal distribution. 

Distributions where ^ < 0 do not often appear in financial models; therefore, financial 
risk management analysis can essentially focus on the first two cases: ^ > 0 and ^ = 0. 
Therefore, one practical consideration the researcher faces is whether to assume either ^ > 0 
or ^ = 0 and apply the respective Frechet or Gumbel distributions and their corresponding 
estimation procedures. There are three basic ways of making this choice. 

1. The researcher is confident of the parent distribution. If the researcher is confident it is 
a /-distribution, for example, then the researcher should assume ^ > 0. 

2. The researcher applies a statistical test and cannot reject the hypothesis ^ = 0. In this 
case, the researcher uses the assumption ^ = 0. 

3. The researcher may wish to be conservative and assume ^ > 0 to avoid model risk. 
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Peaks-Over-Threshold 


LO 45.3: Describe the peaks-over-threshold (POT) approach. 


The peaks-over-threshold (POT) approach is an application of extreme value theory to the 
distribution of excess losses over a high threshold. The POT approach generally requires 
fewer parameters than approaches based on extreme value theorems. The POT approach 
provides the natural way to model values that are greater than a high threshold, and in 
this way, it corresponds to the GEV theory by modeling the maxima or minima of a large 
sample. 

The POT approach begins by defining a random variable X to be the loss. We define u as 
the threshold value for positive values of x, and the distribution of excess losses over our 
threshold u as: 


nrv / iv^ 1 F(x + u)-F(u) 

F^(x) = P{X - u<x|X>u} =-^——- 

1 - F(u) 

This is the conditional distribution for X given that the threshold is exceeded by no more 
than x. The parent distribution of X can be normal or lognormal, however, it will usually be 
unknown. 


Generalized Pareto Distribution 


LO 45.5: Evaluate the tradeoffs involved in setting the threshold level when 
applying the GP distribution. 


The Gnedenko-Pickands-Balkema-deHaan (GPBdH) theorem says that as u gets large, the 
distribution F^(x) converges to a generalized Pareto distribution (GPD), such that: 


1 - 
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if ^ = 0 


The distribution is defined for the following regions: 
X > 0 for ^ > 0 and 0 < x < - (3/^ for ^ < 0 


The tail (or shape) index parameter, is the same as it is in GEV theory. It can be positive, 
zero, or negative, but we are mainly interested in the cases when it is zero or positive. Here, 
the beta symbol, (3, represents the scale parameter. 


The GPD exhibits a curve that dips below the normal distribution prior to the tail. It 
then moves above the normal distribution until it reaches the extreme tail. The GPD then 
provides a linear approximation of the tail, which more closely matches empirical data. 
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Since all distributions of excess losses converge to the GPD, it is the natural model for 
excess losses. It requires a selection of which determines the number of observations, A/^, 
in excess of the threshold value. Choosing the threshold involves a tradeoff It needs to be 
high enough so the GPBdH theory can apply, but it must be low enough so that there will 
be enough observations to apply estimation techniques to the parameters. 


VaR AND Expected Shortfall 

One of the goals of using the POT approach is to ultimately compute the value at risk 
(VaR). From estimates of VaR, we can derive the expected shortfall (a.k.a. conditional 
VaR). Expected shortfall is viewed as an average or expected value of all losses greater than 
the VaR. An expression for this is: E[Lp | Lp > VaR]. Because it gives an insight into the 
distribution of the size of losses greater than the VaR, it has become a popular measure to 
report along with VaR. 


The expression for VaR using POT parameters is given as follows: 


VaR = u + ^ 




-^(1 — confidence level) 

< 

-1 

N 

[ u \ 


where: 

u = threshold (in percentage terms) 
n = number of observations 

= number of observations that exceed threshold 

The expected shortfall can then be defined as: 

1-t 1-^ 


Example: Compute VaR and expected shortfall given POT estimates 

Assume the following observed parameter values: 

• (3 = 0.75. 

• ^ = 0.25. 

• u = 1%. 

• NJn = 5%. 

Compute the 1% VaR in percentage terms and the corresponding expected shortfall 
measure. 


Answer: 


VaR -1 ^ 


0.75 


0.25 


^(1-0.99) 

-0.25 

-1 

[0.05 



= 2.486% 


2.486 0.75-0.25x1 

ES =-h-= 3.981% 

1-0.25 1-0.25 
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Generalized Extreme Value and Peaks-Over-Threshold 


LO 45.4: Compare and contrast generalized extreme value and POT. 


Extreme value theory is the source of both the GEV and POT approaches. These 
approaches are similar in that they both have a tail parameter denoted There is a subtle 
difference in that GEV theory focuses on the distributions of extremes, whereas POT 
focuses on the distribution of values that exceed a certain threshold. Although very similar 
in concept, there are cases where a researcher might choose one over the other. Here are 
three considerations. 

1. GEV requires the estimation of one more parameter than POT. The most popular 
approaches of the GEV can lead to loss of useful data relative to the POT. 

2. The POT approach requires a choice of a threshold, which can introduce additional 
uncertainty. 

3. The nature of the data may make one preferable to the other. 

Multivariate EVT 


LO 45.6: Explain the importance of multivariate EVT for risk management. 


Multivariate EVT is important because we can easily see how extreme values can be 
dependent on each other. A terrorist attack on oil fields will produce losses for oil 
companies, but it is likely that the value of most financial assets will also be affected. We can 
imagine similar relationships between the occurrence of a natural disaster and a decline in 
financial markets as well as markets for real goods and services. 

Multivariate EVT has the same goal as univariate EVT in that the objective is to move 
from the familiar central-value distributions to methods that estimate extreme events. The 
added feature is to apply the EVT to more than one random variable at the same time. This 
introduces the concept of tail dependence, which is the central focus of multivariate EVT. 
Assumptions of an elliptical distribution and the use of a covariance matrix are of limited 
use for multivariate EVT. 

Modeling multivariate extremes requires the use of copulas. Multivariate EVT says that 
the limiting distribution of multivariate extreme values will be a member of the family 
of EV copulas, and we can model multivariate EV dependence by assuming one of these 
EV copulas. The copulas can also have as many dimensions as appropriate and congruous 
with the number of random variables under consideration. However, the increase in 
the dimensions will present problems. If a researcher has two independent variables and 
classifies univariate extreme events as those that occur one time in a 100, this means that 
the researcher should expect to see one multivariate extreme event (i.e., both variables 
taking extreme values) only one time in 100 x 100 = 10,000 observations. For a trinomial 
distribution, that number increases to 1,000,000. This reduces drastically the number of 
multivariate extreme observations to work with, and increases the number of parameters to 
estimate. 
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Key Concepts 


L0 45.1 

Estimating extreme values is important since they can be very costly. The challenge is that 
since they are rare, many have not even been observed. Thus, it is difficult to model them. 


L0 45.2 

Extreme value theory (EVT) can be used to model extreme events in financial markets and 
to compute VaR, as well as expected shortfall. 


L0 45.3 

The peaks-over-threshold (POT) approach is an application of extreme value theory. It 
models the values that occur over a given threshold. It assumes that observations beyond the 
threshold follow a generalized Pareto distribution whose parameters can be estimated. 


LO 45.4 

The GEV and POT approach have the same goal and are built on the same general 
principles of extreme value theory. They even share the same shape parameter: 


L0 45.5 

The parameters of a generalized Pareto distribution (GPD) are the scale parameter (3 and the 
shape parameter Both of these can be estimated using maximum-likelihood technique 

When applying the generalized Pareto distribution, the researcher must choose a threshold. 
There is a tradeoff because the threshold must be high enough so that the GPD applies, 
but it must be low enough so that there are sufficient observations above the threshold to 
estimate the parameters. 


L0 45.6 

Multivariate EVT is important because many extreme values are dependent on each other, 
and elliptical distribution analysis and correlations are not useful in the modeling of extreme 
values for multivariate distributions. Modeling multivariate extremes requires the use of 
copulas. Given that more than one random variable is involved, modeling these extremes 
can be even more challenging because of the rarity of multiple extreme values occurring at 
the same time. 
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Concept Checkers 


1. According to the Fisher-Tippett theorem, as the sample size n gets large, the 

distribution of extremes converges to: 

A. a normal distribution. 

B. a uniform distribution. 

C. a generalized Pareto distribution. 

D. a generalized extreme value distribution. 

2. The peaks-over-threshold approach generally requires: 

A. more estimated parameters than the GEV approach and shares one parameter 
with the GEV. 

B. fewer estimated parameters than the GEV approach and shares one parameter 
with the GEV. 

C. more estimated parameters than the GEV approach and does not share any 
parameters with the GEV approach. 

D. fewer estimated parameters than the GEV approach and does not share any 
parameters with the GEV approach. 

3. In setting the threshold in the POT approach, which of the following statements is 

the most accurate? Setting the threshold relatively high makes the model: 

A. more applicable but decreases the number of observations in the modeling 
procedure. 

B. less applicable and decreases the number of observations in the modeling 
procedure. 

C. more applicable but increases the number of observations in the modeling 
procedure. 

D. less applicable but increases the number of observations in the modeling 
procedure. 

4. A researcher using the POT approach observes the following parameter values: 

(3 = 0.9, ^ = 0.15, u = 2% and N^/n = 4%. The 5% VaR in percentage terms is: 

A. 1.034. 

B. 1.802. 

C. 2.204. 

D. 16.559. 

5. Given a VaR equal to 2.56, a threshold of 1%, a shape parameter equal to 0.2, and a 

scale parameter equal to 0.3, what is the expected shortfall? 


A. 

3.325. 

B. 

3.526. 

C. 

3.777. 

D. 

4.086. 
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Concept Checker Answers 


1. D The Fisher-Tippett theorem says that as the sample size n gets large, the distribution of 

extremes, denoted converges to a generalized extreme value (GEV) distribution. 

2. B The POT approach generally has fewer parameters, but both POT and GEV approaches 

share the tail parameter 


3. A There is a trade-off in setting the threshold. It must be high enough for the appropriate 

theorems to hold, but if set too high, there will not be enough observations to estimate the 
parameters. 


4. B VaR = 2 + 


0.9 


0.15 


[^(1-0.95) 

- 0.15 

-1 

l0.04 J 



VaR= 1.802 


5. A ES = ^ + ^ = ^ + Mz^ = 3.325 


1 -^ 1 -^ 


1 - 0.2 


1 - 0.2 
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The following is a review of the Operational and Integrated Risk Management principles designed to address 
the learning ohjectives set forth hy GARP®. This topic is also covered in: 

Validating Rating Models 


Topic 46 

Exam Focus 

This is a specialized and rather detailed topic that deals with rating system validation. There 
is broad coverage of both qualitative and quantitative validation concepts with greater 
importance being assigned to qualitative validation. For the exam, focus on best practices as 
well as the specific elements of qualitative and quantitative validation. Within the realm of 
quantitative validation, focus specifically on the concepts of calibration and discriminatory 
power. Note that this material is an extension of the Rating Assignment Methodologies topic 
from Book 2 (Topic 19). 


Model Validation 


LO 46.1: Explain the process of model validation and describe best practices for 
the roles of internal organizational units in the validation process. 


According to the Basel Committee (2004) ^ a rating system (or a rating model) “comprises 
all of the methods, processes, controls, and data collection and IT systems that support the 
assessment of credit risk, the assignment of internal risk ratings, and the quantification of 
default and loss estimates.” 

To validate a rating model, a financial institution must confirm the reliability of the results 
produced by the model and that the model still meets the financial institutions operating 
needs and any regulatory requirements. The tools and approaches to validation are regularly 
reassessed and revised to stay current with the changing market and operating environment. 
The breadth and depth of validation should be consistent with the type of credit portfolios 
analyzed, the complexity of the financial institution, and the level of market volatility. 

The rating model validation process includes a series of formal activities and tools to 
determine the accuracy of the estimates for the key risk components as well as the models 
predictive power. The overall validation process can be divided between quantitative and 
qualitative validation. Quantitative validation includes comparing ex post results of risk 
measures to ex ante estimates, parameter calibrations, benchmarking, and stress tests. 
Qualitative validation focuses on non-numerical issues pertaining to model development 
such as logic, methodology, controls, documentation, and information technology. 

The rating model validation process requires confirmation and method of use within 
the financial institution. Results must be sufficiently detailed in terms of weaknesses and 
limitations, in the form of reports that are forwarded regularly to the internal control group 

1. Basel Committee on Banking Supervision (2004 and 2006), “International Convergence of 
Capital Measurement and Capital Standards,” A Revised Framework, Basel, Switzerland. 
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and to regulatory agencies. At the same time, there must be a review of any anticipated 
remedies should the model prove to be weak. A summary of the overall process of model 
validation is provided in Figure 1. 


Figure 1: Model Validation Process 



Source: Figure 5.1. Fundamental steps in rating systems validation process. Reprinted from 
“Developing, Validating and Using Internal Ratings,” by Giacomo De Laurentis, Renato Maino, 
Luca Molteni, (Hoboken, New Jersey: John Wiley & Sons, 2010), p 239. 

Best Practices 


The Basel Committee (2004) outlined the following two key requirements regarding 
corporate governance and oversight: 

“All material aspects of the rating and estimation processes must be approved by the banks 
board of directors or a designated committee thereof and senior management. Those 
parties must possess a general understanding of the banks risk rating system and detailed 
comprehension of its associated management reports. Senior management must provide 
notice to the board of directors or a designed committee thereof of material changes or 
exceptions from established policies that will materially impact the operations of the banks 
rating system.” 

“Senior management must also have a good understanding of the rating systems design 
and operation, and must approve material differences between established procedure and 
actual practice. Management must also ensure, on an ongoing basis, that the rating system 
is operating properly. Management and staff in the credit control function must meet 
regularly to discuss the performance of the rating process, areas needing improvement, and 
the status of efforts to improve previously identified deficiencies.” 
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In response to these two requirements, best practices for the roles of internal organizational 

units in the validation process include: 

1. Senior management needs to examine the recommendations that arise from the 
validation process together with analyzing the reports that are prepared by the internal 
audit group. 

2. Smaller financial institutions require, at a minimum, a manager who is appointed to 
direct and oversee the validation process. 

3. The validation group must be independent from the groups that are developing and 
maintaining validation models and the group(s) dealing with credit risk. The validation 
group should also be independent of the lending group and the rating assignment 
group. Ultimately, the validation group should not report to any of those groups. 

4. Should it not be feasible for the validation group to be independent from designing and 
developing rating systems, then the internal audit group should be involved to ensure 
that the validation group is executing its duties with independence. In such a case, the 
validation group must be independent of the internal audit group. 

5. In general, all staff involved in the validation process must have sufficient training to 
perform their duties properly. 

6. Internal ratings must be discussed when management reports to or meets with the 
credit control group. 

7. The internal audit group must examine the independence of the validation group and 
ensure that the validation group staff is sufficiently qualified. 

8. Given that validation is mainly done using documentation received by groups dealing 
with model development and implementation, the quality of the documentation 

is important. Controls must be in place to ensure that there is sufficient breadth, 
transparency, and depth in the documentation provided. 

A summary of the validation and control processes involving various internal organizational 

units is provided in Figure 2. 
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Figure 2: Validation and Control Processes 
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Source: Table 5.1. Processes and roles of validation and control of internal rating system. Reprinted 
from “Developing, Validating and Using Internal Ratings,” by Giacomo De Laurentis, Renato 
Maino, Luca Molteni, (Hoboken, New Jersey: John Wiley & Sons, 2010), p. 241. 

Comparison of Qualitative and Quantitative Validation Processes 


LO 46.2: Compare qualitative and quantitative processes to validate internal 
ratings, and describe elements of each process. 


The goal of qualitative validation is to correctly apply quantitative procedures and to 
correctly use ratings. Qualitative and quantitative validation are complements although a 
greater emphasis is placed on qualitative validation given its holistic nature. In other words, 
neither a positive nor negative conclusion on quantitative validation is sufficient to make an 
overall conclusion. 

Elements of Qualitative Validation 

Rating systems design involves the selection of the correct model structure in context 
of the market segments where the model will be used. There are five key areas 
regarding rating systems that are analyzed during the qualitative validation process: (1) 
obtaining probabilities of default, (2) completeness, (3) objectivity, (4) acceptance, and 
(5) consistency. 

Obtaining probabilities of default (PD). Using statistical models created from actual 
historical data allows for the determination of the PD for separate rating classes through 
the calibration of results with the historical data. A direct PD calculation is possible with 
logistic regression, whereas other methods (e.g., linear discriminant analysis) require an 
adjustment. An ex post validation of the calibration of the model can be done with data 
obtained during the use of the model. The data would allow continuous monitoring and 
validation of the default parameter to ensure PDs that are consistent with true economic 
conditions. 
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Completeness of rating system. All relevant information should be considered when 
determining creditworthiness and the resulting rating. Given that most default risk models 
include only a few borrower characteristics to determine creditworthiness, the validation 
process needs to provide assurance over the completeness of factors used for credit granting 
purposes. Statistical-based models allow for many borrower characteristics to be used, so 
there needs to be validation of the process of adding variables to the model to have greater 
coverage of appropriate risk factors. 

Objectivity of rating system. Objectivity is achieved when the rating system can clearly define 
creditworthiness factors with the least amount of interpretation required. A judgment- 
based rating model would likely be fraught with biases (with low discriminatory power of 
ratings); therefore, it requires features such as strict (but reasonable) guidelines, proper staff 
training, and continual benchmarking. A statistical-based ratings model analyzes borrower 
characteristics based on actual data, so it is a much more objective model. 

Acceptance of rating system. Acceptance by users (e.g., lenders and analysts) is crucial, so the 
validation process must provide assurance that the models are easily understood and shared 
by the users. In that regard, the output from the models should be fairly close to what is 
expected by the users. In addition, users should be educated as to the key aspects of models, 
especially statistical-based ones, so that they understand them and can make informed 
judgments regarding acceptance. Heuristic models (i.e., expert systems) are more easily 
accepted since they mirror past experience and the credit assessments tend to be consistent 
with cultural norms. In contrast, fuzzy logic models and artificial neural networks are less 
easily accepted given the high technical knowledge demands to understand them and the 
high complexity that creates challenges when interpreting the output. 

Consistency of rating system. The validation process must ensure that the models make sense 
and are appropriate for their intended use. For example, statistical models may produce 
relationships between variables that are nonsensical, so the process of eliminating such 
variables increases consistency. The validation process would test such consistency. In 
contrast, heuristic models do not suffer from the same shortcoming since they are based on 
“real life” experiences. Statistical models used in isolation may still result in rating errors due 
to the mechanical nature of information processing. As a result, even though such models 
can remain the primary source of assigning ratings, they must be supplemented with a 
human element to promote the inclusion of all relevant and important information (usually 
qualitative and beyond the confines of the model) when making credit decisions. 

Additionally, the validation process must deal with the continuity of validation processes, 
which includes periodic analysis of model performance and stability, analysis of model 
relationships, and comparisons of model outputs versus actual outcomes. In addition, the 
validation of statistical models must evaluate the completeness of documentation with 
focus on documenting the statistical foundations. Finally, validation must consider external 
benchmarks such as how rating systems are used by competitors. 

Elements of Quantitative Validation 

Quantitative validation comprises the following areas: (1) sample representativeness, 

(2) discriminatory power, (3) dynamic properties, and (4) calibration. 
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Sample representativeness. Sample representativeness is demonstrated when a sample from 
a population is taken and its characteristics match those of the total population. A key 
problem is that some loan portfolios (in certain niche areas or industries) have very low 
default rates, which frequently results in an overly low sample size for defaulting entities. 

The validation process would use bootstrap procedures that randomly create samples 
through an iterative process that combines items from a default group and items from a 
non-default group. The rating model is reassessed using the new samples; after analyzing a 
group of statistically created models, should the end result be stable and common among 
the models, then the reliability of the result is satisfied. If not, instability risk would still 
persist and further in-depth analysis would be required. Using more homogeneous subsets 
in the form of cluster analysis, for example, could provide a more stable result. Alternatively, 
the model could focus on key factors within the subsets or consider alternative calibrations. 

Discriminatory power. Discriminatory power is the relative ability of a rating model to 
accurately differentiate between defaulting and non-defaulting entities for a given forecast 
period. The forecast period is usually 12 months for PD estimation purposes but is longer 
for rating validation purposes. It also involves classifying borrowers by risk level on an 
overall basis or by specific attributes such as industry sector, size, or geographical location. 

Dynamic properties. Dynamic properties include rating systems stability and attributes of 
migration matrices. In fact, the use of migration matrices assists in determining ratings 
stability. Migration matrices are introduced after a minimum two-year operational period 
for the rating model. Ideal attributes of annual migration matrices include (1) ascending 
order of transition rates to default as rating classes deteriorate, (2) stable ratings over time 
(e.g., high values being on the diagonal and low values being off-diagonal), and (3) gradual 
rating movements as opposed to abrupt and large movements (e.g., migration rates of +/— 
one class are higher than those of +/— two classes). Should the validation process determine 
the migration matrices to be stable, then the conclusion is that ratings move slowly given 
their relative insensitivity to credit cycles and other temporary events. 

Calibration. Calibration looks at the relative ability to estimate PD. Validating calibration 
occurs at a very early stage, and because of the limited usefulness in using statistical tools 
to validate calibration, benchmarking could be used as a supplement to validate estimates 
of probability of default (PD), loss given default (LCD), and exposure at default (EAD). 

The benchmarking process compares a financial institutions ratings and estimates to those 
of other comparable sources; there is flexibility permitted in choosing the most suitable 
benchmark. 


Data Quality 


LO 46.3: Describe challenges related to data quality and explain steps that can be 
taken to validate a models data quality. 


Challenges to Data Quality 

Strong data quality is crucial when performing quantitative validation. General 
challenges involved with data quality include (1) completeness, (2) availability, (3) sample 
representativeness, (4) consistency and integrity, and (5) data cleansing procedures. 
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Defaults are the key constraint in terms of creating sufficiently large data sets for model 
development, rating quantification, and validation purposes. As a result, reliability and 
completeness are important issues. In addition, the definition of default needs to be 
consistent between the potentially wide variety of data collection sources and the Basel II 
definition of default. 

Sample size and sample homogeneity present challenges as well. Practically speaking, it is 
difficult to create samples from a population over a long period using the same lending 
technology. Lending technology refers to the information, rules, and regulations used in 
credit origination and monitoring. In practice, it is almost impossible to have credit rules 
and regulations remain stable for even five years of a credit cycle. Changes occur because of 
technological breakthroughs that allow for more efficient handling of the credit function, 
market changes and new segments that require significant changes to credit policies, 
and merger and acquisition activity. Unfortunately, the changes result in less consistency 
between the data used to create the rating model and the population to which the model is 
applied. 

The time horizon of the data may be problematic because the data should be created from a 
full credit cycle. If it is less than a full cycle, the estimates will be biased by the favorable or 
unfavorable stages during the selected period within the cycle. 

Other data management issues such as outliers, missing values, and unrepresentative data 
may create challenges with validation. 

Note that data quality involves the use of samples in the model building process. It is not 
easy to make inferences about the population merely from the samples used in the model. 

To do so, it is necessary to calibrate appropriately and do out-of-sample testing. Out-of- 
sample testing refers to observations created from the same lending technology but not 
included in the development sample. 

Validating a Models Data Quality 

Validating data quality focuses on the stability of the lending technology and the degree of 
calibration required to infer sample results to the population. For example, if the observed 
in-sample default rate differs from that of the population, then the validation process should 
confirm that the calibration takes into account the difference. Or, if the lending technology 
changes due to a merger or acquisition, then the validation process must confirm the 
corresponding recalibration. The same confirmation of recalibration is required if there are 
material differences between borrowers’ profiles in the sample versus the population. 

An incorrect long-term average annual default rate results in an incorrect default probability, 
so validation must ensure that the long-term default rate is reasonably correct. Statistical 
central tendency is the average value to which population characteristics converge after 
many iterations of a given task. In applying central tendency to defaults, given relatively few 
defaults (i.e., few iterations) in any year during normal periods, it is not usually possible 
for the validation group to properly validate central tendency for at least 18 months. The 
time period is dependent on the markets, the nature of the lending facilities, and the 
characteristics of the customer segments. Validating central tendency in the long term is 
conducted through backtesting and stress testing. 
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The validation group should also watch market prices, consider information from the 
marketing department, and analyze significant transactions to determine appropriate 
benchmarks in which to compare the financial institution with its direct competitors. 


LO 46.4: Explain how to validate the calibration and the discriminatory power of a 
rating model. 


Validating Calibration 

The validation process looks at the variances from the expected PDs and the actual default 
rates. 

The Basel Committee (2005a)^ suggests the following tests for calibration: 

• Binomial test. 

• Chi-square test (or Hosmer-Lemeshow). 

• Normal test. 

• Traffic lights approach. 

The binomial test looks at a single rating category at a time, while the chi-square test looks 
at multiple rating categories at a time. The normal test looks at a single rating category for 
more than one period, based on a normal distribution of the time-averaged default rates. 
Two key assumptions include (1) mean default rate has minimal variance over time and (2) 
independence of default events. The traffic lights approach involves backtesting in a single 
rating category for multiple periods. Because each of the tests has some shortcomings, the 
overall conclusion is that no truly strong calibration tests exist at this time. 

Validating Discriminatory Power 

The validation process is performed ex post using backtesting of defaulting and non¬ 
defaulting items. Therefore, the concept of a longer forecast period requires that the forecast 
period begin further away from t = 0 and from the time the data is collected. 

Validating discriminatory power can be done using the following four methods as outlined 
by the Basel Committee (2005a): 

• Statistical tests (e.g., Fishers r^, Wilks’ X, and Hosmer-Lemeshow). 

• Migration matrices. 

• Accuracy indices (e.g., Lorentz’s concentration curves and Gini ratios). 

• Classification tests (e.g., binomial test. Type I and II errors, chi-square test, and 
normality test). 

The frequency distribution of errors is key to assessing the model’s forecasting reliability. 
With regard to error rates, validation requires an assessment of error tolerance, its 
calibration, and its financial impact (e.g., a false positive or Type I error increases losses, and 
a false negative or Type II error increases opportunity costs). 


2, Basel Committee on Banking Supervision (2005a), “Studies on Validation of Internal Rating 
Systems,” Working Papers 14, Basel, Switzerland. 
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Key Concepts 


L0 46.1 

To validate a rating model, a financial institution must confirm the reliability of the results 
produced by the model and that the model still meets the financial institution’s operating 
needs and any regulatory requirements. The tools and approaches to validation are regularly 
reassessed and revised to stay current with the changing market and operating environment. 

Best practices for the roles of internal organizational units in the validation process include 
active involvement of senior management and the internal audit group. In general, all staff 
involved in the validation process must have sufficient training to perform their duties 
properly. 

With regard to independence, the validation group must be independent from the groups 
that are developing and maintaining validation models and the group (s) dealing with 
credit risk. The validation group should also be independent of the lending group and 
the rating assignment group. Ultimately, the validation group should not report to any of 
those groups. Given that validation is mainly done using documentation received by groups 
dealing with model development and implementation, the quality of the documentation is 
important. Controls must be in place to ensure that there is sufficient breadth, transparency, 
and depth in the documentation provided. 


LO 46.2 

There are five key areas regarding rating systems that are analyzed during the qualitative 
validation process: (1) obtaining probabilities of default, (2) completeness, (3) objectivity, 
(4) acceptance, and (5) consistency. 

Quantitative validation comprises the following areas: (1) sample representativeness, 

(2) discriminatory power, (3) dynamic properties, and (4) calibration. 


LO 46.3 

Defaults are the key constraint in terms of creating sufficiently large data sets for model 
development, rating quantification, and validation purposes. 

With regard to sample size and sample homogeneity, it is difficult to create samples from 
a population over a long period using the same lending technology. Lending technology is 
most likely to change. Unfortunately, the changes result in less consistency between the data 
used to create the rating model and the population to which the model is applied. 

The time horizon of the data may be problematic because the data should take into account 
a full credit cycle. If it is less than a full cycle, the estimates will be biased by the favorable or 
unfavorable stages during the selected period within the cycle. 

Validating data quality focuses on the stability of the lending technology and the degree of 
calibration required to infer sample results to the population. 
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Validating calibration looks at the variances from the expected probabilities of default and 
the actual default rates. Tests of calibration include (1) binomial test, (2) chi-square test (or 
Hosmer-Lemeshow), (3) normal test, and (4) traffic lights approach. 

Validating discriminatory power involves backtesting of defaulting and non-defaulting 
items. Tests of discriminatory power include (1) statistical tests, (2) migration matrices, 

(3) accuracy indices, and (4) classification tests. 
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Concept Checkers 


1. Which of the following statements regarding the model validation process is most 
accurate? 

A. The validation process places equal importance on quantitative and qualitative 
validation. 

B. The validation group could be involved with the rating system design and 
development process. 

C. The quantitative validation process involves an analysis of structure and model 
methodology. 

D. The breadth and depth of validation should be commensurate primarily with 
the dollar value of the loans outstanding. 

2. Which of the following areas of quantitative validation would focus on rating 
systems stability? 

A. Calibration. 

B. Discriminatory power. 

C. Dynamic properties. 

D. Sample representativeness. 

3. The increasing use of heuristic rating models versus statistical rating models would 
most likely be covered under which area of qualitative validation? 

A. Acceptance. 

B. Completeness. 

C. Consistency. 

D. Objectivity. 

4. Which of the following statements regarding the validation of data quality is correct? 

A. Data should be created from a full credit cycle. 

B. Validating central tendency in the long term is done through normality testing. 

C. In practice, it is necessary to create samples from a population over a five-year 
period using the same lending technology. 

D. To make inferences about the population from the samples used in a model, it is 
necessary to calibrate appropriately and do in-sample testing. 

5. Which of the following methods would most likely be used to validate both the 
calibration and the discriminatory power of a rating model? 

A. Accuracy indices. 

B. Classification tests. 

C. Migration matrices. 

D. Traffic lights approach. 
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Concept Checker Answers 


1. B The validation group could be involved with the rating system design and development 

process as long as sufficient controls are in place to ensure independence. For example, the 
internal audit group could confirm that the validation group is acting independently. 

There is more emphasis on qualitative validation over quantitative validation. Structure and 
model methodology is dealt with under qualitative validation, not quantitative. The breadth 
and depth of validation is not primarily focused on the dollar value of the loans outstanding 
and takes a broader approach by considering the type of credit portfolios analyzed, the 
complexity of the financial institution, and the level of market volatility. 

2. C Dynamic properties include rating systems stability and attributes of migration 

matrices. Calibration looks at the relative ability to estimate probability of default (PD). 
Discriminatory power is the relative ability of a rating model to accurately differentiate 
between defaulting and non-defaulting entities for a given forecast period. Sample 
representativeness is demonstrated when a sample from a population is taken and its 
characteristics match those of the total population. 

3. A Heuristic models are more easily accepted since they mirror past experience and the credit 

assessments tend to be consistent with cultural norms. In contrast, statistical models are less 
easily accepted given the high technical knowledge demands to understand them and the high 
complexity that creates challenges when interpreting the output. 

Completeness refers to the sufficiency in number of factors used for credit granting purposes 
since many default-based models use very few borrower characteristics. In contrast, statistical- 
based models allow for many borrower characteristics to be used. Consistency refers to 
models making sense and being appropriate for their intended use. For example, statistical 
models may produce relationships between variables that are nonsensical, so the process 
of eliminating such variables increases consistency. Objectivity is achieved when the rating 
system can clearly define creditworthiness factors with the least amount of interpretation 
required, choosing between judgment-based versus statistical-based models. 

4. A If data is created from less than a full credit cycle, the estimates will be biased by the 

favorable or unfavorable stages during the selected period within the cycle. 

Validating central tendency in the long term is done through backtesting and stress testing. 

In practice, it is almost impossible to have credit rules and regulations remain stable for even 
five years of a credit cycle. To make inferences about the population, it is necessary to use out' 
of-sample testing whereby the observations are created from the same lending technology but 
were not included in the development sample. 

5. B Classification tests include the binomial test, chi-square test, and normality test. Those tests 

are used to analyze discriminatory power and calibration. 

Accuracy indices and migration matrices are used only for discriminatory power. The traffic 
lights approach is used only for calibration. 
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Exam Focus 

Models are indispensible in modern finance in quantifying and managing asset-liability risk 
management, credit risk, market risk, and many other risks. Models rely on a range of data 
input based on a combination of historical data and risk assumptions, and are critical in 
managing risk exposures and financial positions. However, models rely on the accuracy of 
inputs, and errors give rise to model risk. Model risk can range from errors in inputs and 
assumptions to errors in implementing or incorrectly interpreting a model, and can result 
in significant losses to market participants. For the exam, be able to identify and explain 
common model errors, model implementation and valuation issues, and model error 
mitigation techniques. Also, be familiar with the two case studies discussed related to model 
risk: Long-Term Capital Management and the London Whale incident. 


Sources of Model Risk 


LO 47.1: Identify and explain errors in modeling assumptions that can introduce 
model risk. 


Modeling is a critical component in the risk management of an organization. Models 
help quantify risk and other exposures as well as potential losses. However, models can be 
complex and are subject to model risk, which includes input errors, errors in assumptions, 
and errors in interpretation. 

Model Complexity 

When quantifying the risk of simple financial instruments such as stocks and bonds, 
model risk is less of a concern. These simple instruments exhibit less volatility in price and 
sensitivities relative to complex financial instruments so, therefore, their market values tend 
to be good indicators of asset values. However, model risk is a significantly more important 
consideration when quantifying the risk exposures of complex financial instruments, 
including instruments with embedded options, exotic over-the-counter (OTC) derivatives, 
synthetic credit derivatives, and many structured products. For these complex instruments, 
markets are often illiquid and do not provide sufficient price discovery mechanisms, which 
puts greater emphasis on models to value instruments, typically through a mark-to-model 
valuation approach. These models are important not only for valuing instruments and 
assessing risk exposure, but also to determine the proper hedging strategy. 

As financial instruments increase in complexity, so do the models used to value them. More 
complex models, such as the Black-Scholes-Merton option pricing model, increased the 
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threat of model risk, especially for the more complex derivatives such as interest rate caps 
and floors, swaptions, and credit and exotic derivatives. As technology advanced, so did 
the complexity of the models created and used. The growth in complexity of the models 
also increased the reliance on these models. In addition, managers often do not have a solid 
understanding of the more complex models. When models are difficult to understand, the 
risk of model errors and the risk of incorrect vetting, interpretation, and oversight increases. 

The dangers of relying too heavily on complex models became especially apparent 
during the 2007—2009 financial crisis. When markets endure a prolonged period of 
turmoil, models tend to underestimate the volatilities, correlations, and risks of financial 
instruments, and can overstate values, all of which may lead to sustained losses by market 
participants. Since models are often used for valuing instruments, a model may show that 
a strategy is profitable when in fact it is experiencing losses. Following the global credit 
crisis, model risk became more regulated as the Basel Committee mandated that financial 
institutions more rigorously assess model risk. 

Common Model Errors 

Model risk has been apparent over the last several decades through various international 
crises. A model may be incorrect if it contains incorrect assumptions about a financial 
instruments price or risk. One example of model error was the remarkable collapse in 1997 
of a hedge fund run by Victor Niederhoffer, a well-known Wall Street trader. The fund s 
strategy was to write (sell) deep out-of-money put options on the S&P 500, based on the 
assumption that the index volatility would not exceed 5% daily, and therefore, the option 
would expire worthless. In October 1997, the Asian financial crisis created a contagion 
efiFect that impacted North American markets. As a result, market volatilities increased 
significantly above historical levels. This level of volatility was not priced into the advanced 
mathematical models used by the fund which instead assumed a normal distribution of risk 
and historical correlations. The fund ultimately experienced substantial losses as its equity 
was completely wiped out. 

Losses from model errors can be due to errors in assumptions, carelessness, fraud, or 
intentional mistakes that undervalue risk or overvalue profit. The six common model errors 
are as follows: 

1. Assuming constant volatility. One of the most common errors in modeling is the 
assumption that the distribution of asset price and risk is constant. The 2007-2009 
financial crisis showed just how incorrect this assumption can be, when market 
volatilities not predicted by models increased significantly over a short period of time. 

2. Assuming a normal distribution of returns. Market participants frequently make the 
simplifying assumption in their models that asset returns are normally distributed. 

Practice has shown, however, that returns typically do not follow a normal distribution, 
because distributions in fact have fat tails (i.e., unexpected large outliers). 

3. Underestimating the number of risk factors. Many models assume a single risk factor. A 
single risk factor may produce accurate prices and hedge ratios for simple products such 
as a callable bond. For more complex products, including many exotic derivatives (e.g., 

Bermuda options), models need to incorporate multiple risk factors. 


©2018 Kaplan, Inc. 


Page 117 



Topic 47 

Cross Reference to GARP Assigned Reading - Crouhy, Galai, and Mark, Chapter 15 

4. Assuming perfect capital markets. Models are generally derived with the assumption that 
capital markets behave perfectly. Consider a delta hedge strategy that requires active 
rebalancing based on the assumption that the underlying asset position is continuously 
adjusted in response to changes in the derivatives price. This strategy will not be 
effective if capital markets include imperfections, including limitations on short selling, 
various costs (e.g., fees and taxes), and a lack of continuous trading in the markets. 

5. Assuming adequate liquidity. Models often assume liquid markets for long or short 
trading of financial products at current prices. During periods of volatility, especially 
extreme volatility, as seen during the recent financial crisis, liquidity could decline or 
dry up completely. 

6. Misapplying a model. Historically, model assumptions have worked well in most world 
markets, but tend to break down during periods of greater uncertainty or volatility. For 
example, traditional models assuming normality did not work well in many countries, 
including the United States, Europe, and Japan in the post financial crisis period, which 
has been characterized by low or negative interest rates and unconventional monetary 
policies including quantitative easing. In these markets, models that include other 
statistical tools work better. 

Similarly, models that work well for traditional assets could yield incorrect results when 
complex factors including embedded options are factored in. Another example of 
misapplying a model is to use one that was created to value bonds with no embedded 
options (e.g., a non-callable, non-convertible bond) to now value bonds with embedded 
options (e.g., a callable, convertible bond). 


LO 47.2: Explain how model risk can arise in the implementation of a model. 


In the previous section, we looked at the most common model errors. However, even 
correct models can be incorrectly implemented. This section looks at the most common 
implementation issues. Models may be affected by programming bugs or approximation 
errors, and models that seemed to work under normal conditions may have errors when 
tested under stressed market conditions. 

Common Model Implementation Errors 

Implementation error could occur, for example, when models that require Monte Carlo 
simulations are not allowed to run a sufficient number of simulations. In such a case, even 
if all the model inputs and assumptions are correct, the results may still be incorrect if 
insufficient time is given for the computations. 

For the implementation of models, important considerations should include how frequently 
the model parameters need to be refreshed, including volatilities and correlations. Analysts 
responsible for maintaining models must consider whether adjustments should occur 
periodically at scheduled dates, or only when material economic events occur. Similarly, 
the treatment of outliers should also be considered. For example, should outliers be 
considered extreme outcomes only (that is, not part of the true distribution), or should they 
be considered part of the true distribution? Correctly answering these questions became 
especially important in the post-financial crisis period. 
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Correctly estimating parameters like durations, volatilities, and correlations is very difficult, 
and implementing a model with input errors will result in inaccurate results. For example, 
in the 1970s the investment banking firm Merrill Lynch used incorrect hedge durations for 
government bonds, which resulted in a considerable loss to the firm. In another example, 
during the stressed conditions of the financial crisis, default correlations within structured 
products moved toward the binary extremes of + 1 or -1. In other words, the cumulative 
default rates of collateralized debt obligations (CDOs) either all remained below a threshold 
with no defaults in any tranches, or all moved above a threshold, leading to defaults of even 
the AAA-rated tranches. 

Common Valuation and Estimation Errors 

Models also rely on the accuracy of inputs and values fed into the model, and are therefore 
subject to human error. Human error is particularly of concern in new or developing 
markets where adequate controls have not been fully defined and implemented. 

Common valuation and estimation errors include: 

1. Inaccurate data. Models may use both internal and external data sources, where the 
responsibility for data accuracy is not clearly assigned. This could lead to errors from 
using inaccurate data. 

2. Incorrect sampling period length. Increasing the number of observations is expected 
to improve data accuracy and reduce estimation errors. However, including old (and 
therefore obsolete) statistics could put too much weight on stale data. 

3. Liquidity and valuation problems. Accurate pricing and valuation may not be possible in 
all markets. Prices for a particular asset may not exist in certain markets, or the bid-ask 
spread may be too high to offer accurate valuation. 

Mitigating Model Risk 


LO 47.3: Explain methods and procedures risk managers can use to mitigate model 
risk. 


Model risk can be mitigated either through investing in research to improve the model or 
through an independent vetting process. Investing in research leads to developing better and 
more accurate statistical tools, both internally and externally. Independent vetting includes 
the independent oversight of profit and loss calculations as well as the model selection and 
construction process. Vetting consists of the following six phases: 

1. Documentation. Documentation should contain the assumptions of the underlying 
model and include the mathematical formulas used in the model. It should contain a 
term sheet to describe the transaction, a mathematical statement of the model (all the 
variables and processes, payoff function and pricing algorithms, calibrations, and hedge 
ratios and sensitivities), and the implementation features, including inputs, outputs, 
and any numerical methods. 
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2. Model soundness. Vetting should ensure that the model used is appropriate for the 
financial instrument being valued. For example, a model valuing option-free bonds 
would not be appropriate to value convertible or callable bonds. 

3. Independent access to rates. To facilitate independent parameter estimation, the model 
vetter should ensure that the middle office has access to independent financial rates. 

4. Benchmark selection. The vetting process should include selecting the appropriate 
benchmark based on assumptions made. Results from the benchmark test should be 
compared with the results from the model test. 

5. Health check and stress test. Models should be vetted to ensure they contain all necessary 
properties and parameters. Models should also be stress tested to determine the range of 
values for which the model provides accurate pricing. 

6. Incorporate model risk into the risk management framework. Model risk should be 
considered in the formal risk management governance and framework of an institution. 
In addition, models need to be periodically reevaluated for relevance and accuracy. 
Empirical evidence suggests that simple, robust models work better than more complex 
and less robust models. 

Case Studies Related to Model Risk 


LO 47.4: Explain the impact of model risk and poor risk governance in the 
2012 London Whale trading loss and the 1998 collapse of Long Term Capital 
Management. 


The impact of model risk has been felt significantly during two specific incidents: the 
1997 collapse of Long-Term Capital Management (LTCM) and the 2012 “London 
Whale” trading loss at JPMorgan Chase (JPM). Both incidents illustrate the necessity to 
closely examine and vet models, and the importance of considering model risk within an 
organizations institutional risk governance framework. 

Long-Term Capital Management 


Background and Trading Strategies 

LTCM was a U.S. hedge fund that existed between 1994 and 1998. The fund raised in 
excess of $ 1 billion in capital at its inception and grew rapidly over its initial years. LTCM s 
trading strategy relied on arbitrage positions based on market-neutral and relative-value 
trading. The fund began primarily as a bond arbitrage hedge fund that sought to make 
money by exploiting the spread differentials between bonds, including spread differences 
of European sovereign bonds and spread differences of corporate bonds and government 
Treasuries in the United States and United Kingdom. 

LTCM relied on a combination of extensive empirical research and advanced financial 
modeling to formulate bets on convergence of prices in bond markets. For example, the 
fund was long (bought) Spanish and Italian sovereign debt and was short (sold) German 
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sovereign debt. The strategy assumed that German sovereign bonds were overpriced relative 
to the weaker Spanish and Italian bonds, which were expected to increase in value with the 
imminent membership in the European economic and monetary union. 

Another strategy was based on the expected convergence between the spreads of corporate 
and government bonds in the United States and United Kingdom, where spreads were 
expected to return to normal levels. This strategy was designed to make a profit regardless 
of the movement in price levels, assuming, however, that spreads moved in the appropriate 
direction and that correlations did not change materially. 

Leverage, Correlations, and Volatility 

LTCM s strategies were designed to generate only modest profits (around 1%). In order for 
the fund to generate strong performance, it needed to use extensive leverage of up to 25 
times. Such leveraged positions relied on large institutional loans that were collateralized by 
bond investments. Shortly before the funds collapse in 1998, LTCM had capital of close 
to $5 billion, assets of over $125 billion, and a notional value of investments in excess of 
$1.25 trillion. The magnitude of LTCM s leveraged investments was unprecedented in the 
markets. 

LTCM s strategies worked as long as positions converged as anticipated, and as long as 
correlations did not deviate significantly from historical levels. Volatilities were calculated 
based on mathematical models to be approximately in line with the risk of investing in the 
S&P 500. However, at the time of the funds collapse, its one-day volatility exceeded its 
model predicted volatility by 2.5 times, and the fund suffered losses of more than 3 times its 
10-day predicted maximum loss. 

Collapse and Lessons 

In 1997, Asian markets experienced considerable economic and financial problems that 
quickly spread to several economies as contagion increased. These troubles ultimately 
affected Russia, which was forced to devalue its currency, the ruble, and default on its 
sovereign debt in August 1998. The Asian and Russian crisis triggered a flight-to-quality 
in European and North American markets with investors seeking the safe and predictable 
returns of high-quality sovereign bonds. As a result, the yields of the U.S. and German 
long-term sovereign bonds declined (their prices increased), while at the same time the 
yields on the riskier corporate bonds and riskier sovereign bonds (for example, Italy and 
Spain) increased (their prices fell). Credit spreads widened, volatilities increased beyond 
historical levels, and correlations in the market moved closer to +1 as the contagion effect of 
the crisis spread across markets. 

With higher volatilities and dramatically widening spreads, the profits on LTCM s short 
positions were no longer sufficient to offset the losses on its long positions. With losses 
mounting, lenders demanded additional collateral. In order to meet collateral calls, 

LTCM had to unwind several unprofitable trades that put further downward pressure on 
markets given the size of the fund s trading positions. At the same time, liquidity in the 
markets quickly began to dry up, leaving many of LTCM s market-neutral positions now 
directionally exposed on the long side. Ultimately, the fund became insolvent in September 
1998 and was bailed out by the Federal Reserve Bank of New York in order to curb a 
potential global financial crisis. 
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LTCM s collapse highlighted several flaws in its regulatory value at risk (VaR) calculations: 

1. The fund s calculated 10-day VaR period was too short. A time horizon for economic 
capital should be sufficiently long enough to raise new capital, which is longer than the 
10-day assumption. 

2. The fund s VaR models did not incorporate liquidity assumptions. The assumption of 
perfectly liquid markets proved to be incorrect when the fund experienced liquidity 
droughts. 

3. The funds risk models did not incorporate correlation and volatility risks. This 
weakness was especially evident when markets moved to a correlation of close to +1 and 
volatility increased significantly above historical and model predicted levels. 

London Whale 


Background and Trading Strategy 

JPMorgan Chase & Company (JPM), along with its principal banking subsidiary JPMorgan 
Chase Bank, is a U.S. financial company and one of the largest derivatives traders in the 
world. JPM garnered international headlines when in the first half of 2012 it sustained 
losses in excess of $6 billion due to risky synthetic credit derivatives trades executed by a 
trader, called the “London Whale”, in its London office. The London trading desk belonged 
to JPMs Chief Investment Office (CIO), which was responsible for managing the banks 
excess deposits. 

The CIO was tasked with keeping the banks risk level down and prudently managing the 
banks $350 billion in excess deposits. Instead, the CIO used the deposits to engage in high- 
profit potential, high-risk derivatives trading strategies. In 2006, the CIO began a new series 
of synthetic credit derivatives trading strategies within its Synthetic Credit Portfolio (SCP). 
Trading focused less on hedging risk and more on earning profits from short positions. 

Risk Culture, Model Risk, and Operational Risk 

The CIO used various risk metrics for its trading activities, including VaR limits and credit 
spread widening limits. 

In 2011, the CIO was instructed to reduce the banks risk-weighted assets (RWA) in order 
to reduce regulatory capital requirements. Instead of the common practice of selling high 
risk assets, the CIO instead launched a trading strategy to offset its outstanding short 
positions by taking long positions in synthetic credit derivatives. This resulted not only in 
an increase in the portfolio s risk and size, but it also put the portfolio in a net long position, 
which reduced the hedging protection provided by the SCP. 

Concurrently, in early 2012, and in response to breaching its own internal VaR limits 
as well as the banks VaR limits, the CIO adopted a new VaR model which lowered its 
calculated VaR by 50%. The revised model allowed the CIO to remain within its VaR 
limit and at the same time engage in more higher-risk trading activities. However, the 
bank failed to seek regulatory approval of the new model. In addition, there were manual 
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and calculation errors when implementing the model, which led to greater model and 
operational risk for the bank. Ultimately, the revised VaR model was reversed later in 2012 
and the previous model was reinstated. 

By 2012, the SCP was losing money on its strategies. In order to minimize its reported 
losses, the CIO changed its derivatives valuation practices from using midpoint prices 
(prices at the midpoint of the bid and ask) to using more favorable prices within the bid-ask 
spread during each day. As the losses in the SCP strategy increased, JPM s counterparties 
began to dispute the CIO s values, which led to frequent collateral disputes. Ultimately, 

JPM s positions soured and the bank lost close to $6.2 billion. 

The losses from the London Whale trade and the subsequent investigations revealed a poor 
risk culture at JPM. Risk limits were routinely downplayed or ignored, limit breaches were 
disregarded, and risk models were altered to favor riskier trading activities. 
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Key Concepts 


L0 47.1 

Model risk becomes important when quantifying the risk exposures of complex financial 
instruments, including exotic or synthetic derivatives and structured products. Model 
risk can give rise to losses from model errors, errors in assumptions, carelessness, fraud, or 
intentional mistakes. These errors can lead to undervaluing risk, overvaluing profit, or both. 
Six common model errors include: 

1. Assuming constant volatility. 

2. Assuming a normal distribution of returns. 

3. Underestimating the number of risk factors. 

4. Assuming perfect capital markets. 

5. Assuming adequate liquidity. 

6. Misapplying a model. 

LO 47.2 

Implementation error could occur when models that require complex simulations are 
not allowed to run a sufficient number of runs. This may result in incorrect output and 
therefore an incorrect interpretation of results. 

For model implementation, considerations include frequency of refreshing model 
parameters, including volatilities and correlations. Correctly estimating parameters 
(durations, volatilities, and correlations) is challenging, however, implementing a model 
with input errors will result in inaccurate results. 

Common valuation and estimation errors include: 

1. Inaccurate data. 

2. Incorrect sampling period length. 

3. Liquidity and valuation problems. 
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LO 47.3 

Model risk can be mitigated either through investing in research to improve the model, or 
through an independent vetting process. Vetting consists of six phases: 

1. Documentation. 

2. Vetting the soundness of the model. 

3. Ensuring independent access to rates. 

4. Benchmark selection. 

5. Health check and stress testing of the model. 

6. Incorporating model risk into the risk management framework. 

LO 47.4 

Long-Term Capital Management (LTCM) was a U.S. hedge fund that used arbitrage 
strategies to exploit spread differentials between bonds, including spread differences of 
European sovereign bonds and spread differences in corporate bonds and government 
Treasuries. LTCM s strategy was to make predictable, low returns and then amplify them 
using extensive leverage. 

The collapse of LTCM in 1998 highlights three important lessons: 

1. Utilizing a 10-day VaR period as a proxy for the time horizon for economic capital is 
too short. A time horizon is needed that is sufficiently long enough to model the time 
to raise new capital. 

2. The fund’s VaR models ignored the possibility that liquidity may decline or even 
completely dry up in periods of extreme stress. 

3. The fund’s risk models ignored correlation and volatility risks. Specifically, the fund 
did not account for stressed scenarios with material rises in volatility or an increase in 
positive market correlation as contagion risk spread across international economies. 

In 2012, JPMorgan Chase (JPM) and its Chief Investment Office (CIO) sustained severe 
losses due to risky synthetic credit derivatives trades executed by its London office. The 
losses from the London Whale trade and the subsequent investigations highlighted a poor 
risk culture at JPM, giving rise to both model and operational risks across the firm. Risk 
limits were routinely ignored and limit breaches were disregarded. 
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Concept Checkers 


1. A risk analyst for a mid-sized bank believes that two common errors in model 
building include the assumption of constant volatility of returns and the assumption 
of a non-normal returns distribution. The analyst is correct with regard to the 
assumption(s) of: 

A. volatility of returns only. 

B. non-normal returns distribution only. 

C. both volatility of returns and non-normal returns distributions. 

D. neither volatility of returns nor non-normal returns distributions. 

2. Which of the following scenarios is the best example of a model error? 

A. Assuming a non-normal distribution of returns. 

B. Assuming perfectly liquid markets. 

C. Assuming variable distribution of asset price. 

D. Assuming imperfect capital markets. 

3. The chief risk officer (CRO) of a European corporation recommends increasing the 
length of the sampling period in order to minimize model risk. However, increasing 
the length of the sampling period will most likely: 

A. increase estimation errors. 

B. diminish the power of the statistical test. 

C. put higher weight on obsolete information. 

D. diminish the relevance of old data. 

4. Gamma Investments, LLC (Gamma) uses monthly model vetting to mitigate 
potential model risk. Gammas managers recently accepted the use of a model for 
valuing short-term options on 30-year corporate bonds, but rejected the same model 
to value short-term options on three-year government bonds. The managers also 
frequently test proposed analytical models against a simulation approach. These 
model vetting techniques are examples of which of the following vetting phases? 



Accepting/rejecting a model 

Testing models against simulation 

A. 

Health check of the model 

Stress testing 

B. 

Soundness of a model 

Stress testing 

C. 

Health check of the model 

Benchmark modeling 

D. 

Soundness of a model 

Benchmark modeling 


5. Which of the following flaws in Long-Term Capital Managements (LTCM) value at 
risk (VaR) calculations were most evident following its collapse in 1998? 

I. The calculated 10-day VaR period was too short. 

II. The fund s VaR model assumed strong positive correlation. 

A. I only. 

B. II only. 

C. Both I and II. 

D. Neither I nor II. 
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Concept Checker Answers 


1. A The analyst is correct with respect to the assumption of volatility of returns only. Another 

common model error is the assumption of a normal distribution of returns. Market 
participants frequently make the simplifying assumption in their models that asset returns 
are normally distributed. However, empirical research shows that returns tend to be non- 
normally distributed. 

2. B Six common model errors include: (1) assuming constant volatility, (2) assuming a normal 

distribution of returns, (3) underestimating the number of risk factors, (4) assuming perfect 
capital markets, (5) assuming adequate liquidity, and (6) misapplying a model. 

3. C Adding more observations to the model reduces estimation errors and improves the power of 

statistical tests. However, it gives greater relevance to old and potentially stale data and puts 
greater weight on obsolete information which may now be irrelevant. 

4. D Accepting the model for one use but rejecting it for another (inappropriate) use is an example 

of vetting the soundness of the model. In other words, the model vetter (in this case the risk 
managers) should ensure that the mathematical model reasonably represents the asset being 
valued. 

Testing a proposed analytical model against a simulation approach or a numerical 
approximation technique is an example of benchmark modeling. 

Health check of the model ensures that the model contains all of the necessary properties. 
Stress testing a model uses simulations to check the models reaction to different situations. 

5. A LTCM s collapse highlighted several flaws in its regulatory VaR calculations. The fund relied 

on a VaR model that: (1) used a 10-day horizon, which proved to be too short to sufficiently 
model the time to raise new capital, (2) did not factor in liquidity risk (in other words, it 
assumed markets were perfectly liquid), and (3) did not incorporate correlation and volatility 
risks, where in fact markets exhibited strong positive correlation during periods of stress in 
1997 and 1998. 
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Topic 48 

Exam Focus 

This topic covers the application of the risk-adjusted return on capital (RAROC) approach 
to the allocation of economic capital. The application of a hurdle rate for capital budgeting 
decisions as well as an adjusted version of the traditional RAROC approach is also presented. 
For the exam, know the differences between economic capital and regulatory capital, and be 
able to compute RAROC for capital budgeting as well as adjusted RAROC. Also, be familiar 
with the qualitative concepts discussed, such as reasons for using economic capital to allocate 
risk capital, the benefits of RAROC, and best practices in implementing the RAROC approach. 


Risk Capital, Economic Capital, and Regulatory Capital 


LO 48.1: Define, compare, and contrast risk capital, economic capital, and 
regulatory capital, and explain methods and motivations for using economic capital 
approaches to allocate risk capital. 


Risk capital provides protection against risk (i.e., unexpected losses). In other words, it 
can be defined as a (financial) buffer to shield a firm from the economic impact of risks 
taken. Should a disastrous event occur, those impacts could otherwise jeopardize the firm’s 
financial security and its ability to remain a going concern. In short, risk capital provides 
assurance to the firms stakeholders that their invested funds are safe. In most cases, risk 
capital and economic capital are treated synonymously, although an alternative definition of 
economic capital exists (discussed further in LO 48.3): 


economic capital = risk capital + strategic risk capital 


On the other hand, there are at least three distinct differences between risk capital and 
regulatory capital as follows: 

1. Unlike risk capital, regulatory capital is relevant only for regulated industries such as 
banking and insurance. 

2. Regulatory capital is computed using general benchmarks that apply to the industry. 
The result is a minimum required amount of capital adequacy that is usually far below 
the firms risk capital. 
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3. Assuming that risk capital and regulatory capital are the same for the overall firm, 
the amounts may be different within the various divisions of the firm. From a risk 
capital allocation perspective, one solution is to allocate the greater of risk capital and 
regulatory capital to a certain division. 


Professor's Note: We will examine the regulatory capital charges for credit, 
market, and operational risk in the Basel readings later in this book. 


Given that Basel III requirements are sufficiently robust, it is probable that in certain areas 
(e.g., securitization), regulatory capital will be substantially higher than risk/economic 
capital. Although the two amounts may conflict, risk/economic capital must be computed 
in order to determine the economic viability of an activity or division. Assuming that 
regulatory capital is substantially higher than risk/economic capital for a given activity, then 
that activity will potentially move over to shadow banking (i.e., unregulated activities by 
regulated financial institutions) in order to provide more favorable pricing. 


Using Economic Capital Approaches 


From the perspective of financial institutions, the motivations for using economic capital 
are as follows: 

Capital is used extensively to cushion risk. Compared to most other non-financial institutions, 
financial institutions can become highly leveraged (i.e., riskier) at a relatively low cost 
simply by accepting customer deposits or issuing debt. All of this may occur without 
having to issue equity. Additionally, many of the financial institutions will participate in 
transactions involving derivatives, guarantees, and other commitments that only require a 
relatively small amount of funding but always involve some risk. As a result, all of the firms 
activities must be allocated an economic capital cost. 

Financial institutions must be creditworthy. A unique aspect of financial institutions is that 
their main customers are also their main liability holders. Customers who deposit funds to 
a financial institution will be concerned about the default risk of the financial institution. 
With over-the-counter (OTC) derivatives, the concern is counterparty risk. As a result, 
a sufficient amount of economic capital must be maintained to provide assurance of 
creditworthiness. 

There is difficulty in providing an external assessment of a financial institutions creditworthiness. 
It is challenging to provide an accurate credit assessment of a financial institution because 
its risk profile is likely to be constantly evolving. For example, an institution may engage 
in complicated hedging and derivatives transactions that could rapidly impact its liquidity. 
Therefore, having a sufficient store of economic capital could mitigate this problem and 
provide assurance of financial stability. 

Profitability is greatly impacted by the cost of capital. Economic capital is similar to equity 
capital in the sense that the invested funds do not need to be repaid in the same manner as 
debt capital, for instance. In other words, economic capital serves as a reserve or a financial 
cushion in case of an economic downturn. As a result, economic capital is more expensive 
to hold than debt capital, thereby increasing the cost of capital and reducing the financial 
institutions profits. A proper balance between holding sufficient economic capital and 
partaking in risky transactions is necessary. 
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Risk-Adjusted Return on Capital 


LO 48.2: Describe the RAROC (risk-adjusted return on capital) methodology and 
its use in capital budgeting. 


The risk-adjusted return on capital (RAROC) methodology provides users with 
information pertaining to the risk-adjusted performance of the firm and its business units as 
opposed to merely the “raw” performance numbers. In measuring economic performance, 
this methodology involves allocating risk capital to the firms business units and to specific 
transactions. 

Benefits of RAROC include: 

1. Performance measurement using economic profits instead of accounting profits. 
Accounting profits include historical and arbitrary measures such as depreciation, which 
may be less relevant. 

2. Use in computing increases in shareholder value as part of incentive compensation (e.g., 
scorecards) within the firm and its divisions. The flexibility of RAROC may also allow 
for deferred/contingent compensation or clawbacks for subsequent poor performance. 

3. Use in portfolio management for buy and sell decisions and use in capital management 
in estimating the incremental value-added through a new investment or discontinuing 
an existing investment. 

4. Using risk-based pricing, which will allow proper pricing that takes into account the 
economic risks undertaken by a firm in a given transaction. Each transaction must 
consider the expected loss and the cost of economic capital allocated. Many firms use 
the “marginal economic capital requirement” portion of the RAROC equation for the 
purposes of pricing and determining incremental shareholder value. 


LO 48.3: Compute and interpret the RAROC for a project, loan, or loan portfolio, 
and use RAROC to compare business unit performance. 


The necessary amount of economic capital is a function of credit risk, market risk, and 
operational risk. The RAROC for a project or loan can be defined as risk-adjusted return 
divided by risk-adjusted capital. The basic RAROC equation is as follows: 


RAROC = 


after-tax expected risk-adjusted net income 
economic capital 


There is a tradeoff between risk and return per unit of capital with the numerator acting as 
return and the denominator acting as risk. For example, a business units RAROC needs to 
be greater than its cost of equity in order to create shareholder value. 


Furthermore, measures such as return on equity (ROE) or return on assets (ROA) are 
based on accounting book values only, and therefore are unable to account for the relevant 
risks. RAROC has two specific adjustments to these measures. In the numerator, it deducts 
expected loss (the risk factor) from the return. In the denominator, it replaces accounting 
capital with economic capital. 
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The underlying principles of the RAROC equation are similar to two other common 
measures of risk/return: (1) the Sharpe ratio, which equals: (expected return - risk-free rate) 
/ standard deviation, and (2) the net present value (NPV), which equals the discounted 
value of future expected after-tax cash flows. The discount rate for the NPV is a risk- 
adjusted expected return that uses beta (captures systematic risk only) from the capital asset 
pricing model (CAPM). In contrast to NPV, RAROC takes into account both systematic 
and unsystematic risk in its earnings figure. 


A more detailed RAROC equation to use for capital budgeting decisions is as follows: 


RAROC = 


exp ected revenues — cos ts — exp ected losses 
— taxes + return on economic capital zb transfers 

economic capital 


Where: 

• Expected revenues assume no losses and costs refer to direct costs. Taxes are computed 
using the firms effective tax rate and transfers include head office overhead cost 
allocations to the business unit as well as transactions between the business unit and the 
treasury group, such as borrowing and hedging costs. 

• Expected losses (EL) consist mainly of expected default losses (i.e., loan loss reserve), 
which are captured in the numerator (i.e., higher funding cost) so there is no adjustment 
required in the denominator. Expected losses also arise due to market, operational, and 
counterparty risks. 

• Return on economic capital refers to the return on risk-free investments based on the 
amount of allocated risk capital. 

• Economic capital includes both risk capital and strategic risk capital. 

Risk capital serves as a buffer against unexpected losses. It is the amount of funds that the 
firm must hold in reserve to cover a worst-case loss (an amount over the expected loss) at 
a specific confidence level that is usually 95% or more. Therefore, it is very similar to the 
annual value at risk (VaR). 

Strategic risk capital pertains to the uncertainty surrounding the success and profitability 
of certain investments. An unsuccessful investment could result in financial losses and 
a negative reputational impact on the firm. Strategic risk capital includes goodwill and 
burned-out capital. 

• Goodwill is the excess of the purchase price over the fair value (or replacement value) of 
the net assets recorded on the balance sheet. A premium price may exist because of the 
existence of valuable but unrecorded intangible assets. 

• Burned-out capital represents the risk of amounts spent during the start-up phase of 
a venture that may be lost if the venture is not pursued because of low projected risk- 
adjusted returns. The venture may refer to a recent acquisition or an internally generated 
project. Burned-out capital is amortized over time as the strategic failure risk decreases. 

Finally, firms may allocate risk capital to any unused risk limits (e.g., undrawn amounts on 
a line of credit) because risk capacity could be utilized any time. If risk capacity is utilized, 
the firm would then have to adjust the risk capital amount. 

As mentioned, economic capital is designed to provide a cushion against unexpected losses 
at a specified confidence level. The confidence level at which economic capital is set can 
be viewed as the probability that the firm will be able to absorb unexpected losses over 
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a specified period. A simple example can help illustrate the concept of unexpected loss 
and how it is equal to the risk capital allocation. Assume for a given transaction that the 
expected loss is 20 basis points (bps) and the worst-case loss is 190 bps at a 95% confidence 
level over one year. Based on this information, the unexpected loss is 170 bps (excess of 
worst-case loss over expected loss). There is also still a 5% probability that the actual loss 
will exceed 190 bps. 


Example: RAROC calculation 


Assume the following information for a commercial loan portfolio: 

• $1.5 billion principal amount 

• 7% pre-tax expected return on loan portfolio 

• Direct annual operating costs of $10 million 

• Loan portfolio is funded by $1.5 billion of retail deposits; interest rate = 5% 

• Expected loss on the portfolio is 0.5% of principal per annum 

• Unexpected loss of 8% of the principal amount, or $120 million of economic capital 
required 

• Risk-free rate on government securities is 1% (based on the economic capital 
required) 

• 25% effective tax rate 

• Assume no transfer pricing issues 

Compute the RAROC for this loan portfolio. 

Answer: 


First, calculate the following RAROC components: 

Expected revenue = 0.07 x $1.5 billion = $105 million 
Interest expense = 0.05 x $1.5 billion = $75 million 
Expected loss = 0.005 x $1.5 billion = $7.5 million 
Return on economic capital = 0.01 x $120 million = $1.2 million 

Then, apply the RAROC equation: 


RAROC 


(105 -10-75 -7.5 + 1.2 + 0)x(l-0.25) 
120 


8.56% 


Therefore, maintenance of the commercial loan portfolio requires an after-tax expected 
rate of return on equity of at least 8.56%. 


Note that for capital budgeting projects, expected revenues and losses should be used in the 
numerator since the analysis is being performed on an ex ante (or before the fact) basis. In 
contrast, for performance evaluation purposes on an ex post (or after the fact) basis, realized 
(or actual) revenues and losses should be used. 
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LO 48.4: Explain challenges that arise when using RAROC for performance 
measurement, including choosing a time horizon, measuring default probability, 
and choosing a confidence level. 


Time Horizon 

In computing RAROC, the focus so far has been on one period (i.e., one-year time 
horizon) since it is convenient from a business planning cycle perspective and it represents 
the probable amount of time needed for a firm to recover from a significant unexpected 
loss. At the same time, it is possible to look at multi-period RAROC to obtain a more 
accurate RAROC measure for longer-term transactions and loans. One issue that arises is 
how much economic capital to allocate if the risk of a transaction changes dramatically in 
subsequent periods. For example, using an averaging method would give rise to periods of 
overcapitalization and periods of undercapitalization. 

Risk capital could be thought of as the firms one-year VaR at a specific confidence level 
(e.g., 95% or 99%). For both credit risk and operational risk, no adjustments are required 
from one-year VaR to compute risk capital. For market risk, short time horizons such as one 
day (risk monitoring) or 10 days (regulatory capital) require adjustments to determine the 
correct one-year risk capital allocation. 

One basic approach is the “square root of time” rule whereby one-year VaR is estimated 
by multiplying the one-day VaR by the square root of 252 business days in the year. This 
approach needs to be fine-tuned by considering that even in a worst-case scenario, the firm 
might only be able to reduce its risk to a core risk level to retain its status as a financially 
viable business for the rest of the year. Furthermore, the computation must also factor in the 
time needed to lower the current risk level to the core risk level (i.e., “time to reduce”). That 
amount of time corresponds to the relative liquidity (during difficult market conditions) of 
the firms investment positions taken. As a result, a large amount of time may be required 
for a reasonable liquidation of the positions. 


Example: Risk capital for market risk 

Assume the following information where the core risk level is below the current risk 
level: 

• Daily value at risk (VaR) = 80 

• Core risk level = 60 

• Days needed to reduce current risk level to core risk level =10 (i.e., risk reduction of 
2 VaR per day) 

• Number of business days per year = 252 

Compute the required risk capital as a percentage of annualized VaR. 
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Answer: 


Risk capital = square root 


sum of squares + 

core risk level squared X (number of business days per year — 
days needed to reduce current to core) 

(80^ + 78^ + 76^ + 74^ + 72^ + 70^ + 68^ + 66^ + 64^ +62^) + 

= square root i ^ , i 

^ |60^x(252-10)| 

= square root [50,740 + (3,600 x 242)] 

= ^921,940 =960.18 

Note that annualized VaR = 80 x square root of 252 = 1,269.96 


Therefore, the risk capital required is approximately 75.6% of annualized 
VaR (960.18/ 1,269.96). 


There is a lot of subjectivity in selecting the time horizon for RAROC calculation purposes. 
A longer time horizon could be selected to account for the full business cycle; it may not 
always increase the risk capital required since the confidence level required to maintain 
a firm’s solvency will fall as the time horizon is increased. A key consideration with the 
selection of a time horizon is the fact that risk and return data for periods over one year is 
likely to be of questionable reliability. 

Default Probability 

A point'in'time (PIT) probability of default could be used to compute short-term expected 
losses and to price financial instruments with credit risk exposure. A through-the-cycle 
(TTC) probability of default is more commonly used for computations involving economic 
capital, profitability, and strategic decisions. 

A firms rating is more likely to change when analyzed under the PIT approach versus the 
TTC approach. As a result, the TTC approach results in a lower volatility of economic 
capital versus the PIT approach. From time to time, it is advisable to compare the result of 
PIT versus TTC for RAROC computations at a stable portion of the economic cycle and at 
the lowest portion of the cycle. 

Confidence Level 

In computing economic capital, the confidence level chosen must correspond with the firms 
desired credit rating. A high rating such as AA or AAA would require a confidence level in 
excess of 99.95%, for example. Choosing a lower confidence level will reduce the amount 
of risk capital required/allocated and it will impact the risk-adjusted performance measures. 
The reduction may be dramatic if the firm is primarily exposed to operational, credit, and 
settlement risks where large losses are rare. 
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Hurdle Rate for Capital Budgeting Decisions 


LO 48.5: Calculate the hurdle rate and apply this rate in making business decisions 
using RAROC. 


Similar to internal rate of return (IRR) analysis, the use of a hurdle rate (i.e., after-tax 
weighted average cost of equity capital) is compared to RAROC in making business 
decisions. In general, the hurdle rate should be revised perhaps once or twice a year or when 
it has moved by over 10%. 

The hurdle rate, h^y is computed as follows: 

|(CExRce) + (PExRpe)| 

(CE + PE) 


where: 

CE = market value of common equity 
PE = market value of preferred equity 

R^£ = cost of common equity [could be derived from the capital asset pricing model 
(CAPM)] 

Rpj. = cost of preferred equity (yield on preferred shares) 

Recall, that the CAPM formula is as follows: 

Rce = Rp + PcE (Rm - Rp) 


where: 

Rp = risk-free rate 

R^ = expected return on market portfolio 
PcE = fitnis common equity market beta 

Once the hurdle rate and the RAROC are calculated, the following rules apply: 

• If RAROC > hurdle rate, there is value creation from the project and it should be 
accepted. 

• If RAROC < hurdle rate, there is value destruction from the project and it should be 
rejected/ discontinued. 

Obviously, a shortcoming of the above rules is that higher return projects that have a 
RAROC > hurdle rate (accepted projects) also come with high risk that could ultimately 
result in losses and reduce the value of the firm. In addition, lower return projects that 
have a RAROC < hurdle rate (rejected projects) also come with low risk that could provide 
steady returns and increase the value of the firm. As a result, an adjusted RAROC measure 
should be computed. 
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Adjusted RAROC 


LO 48.6: Compute the adjusted RAROC for a project to determine its viability. 


RAROC should be adjusted to consider systematic risk and a consistent hurdle rate. 
Adjusted RAROC = RAROC —13£ (Rjvi “ Rp) 


where: 

Rp = risk-free rate = hurdle rate 

Rj^ = expected return on market portfolio 

Pp = firms equity beta 

(R^ — Rp) = excess return over risk-free rate to account for the nondiversifiable 
systematic risk of the project 

Therefore, the revised business decision rules are as follows: 

• If adjusted RAROC > Rp, then accept the project 

• If adjusted RAROC < Rp, then reject the project 


Example: Adjusted RAROC 

Suppose RAROC is 12%, the risk-free rate is 5%, the market return is 11%, and the 
firms equity beta is 1.5. Use ARAROC to determine whether the project should be 
accepted or rejected. 

Answer: 

Adjusted RAROC = RAROC -13£ (R^ - Rp) 

= 0.12 -1.5(0.11 - 0.05) = 0.12 - 0.09 = 0.03 

The project should be rejected because the ARAROC of 3% is less than the risk-free 
rate of 5%. 


Risk Capital and Diversification 


LO 48.7: Explain challenges in modeling diversification benefits, including 
aggregating a firms risk capital and allocating economic capital to different 
business lines. 


The overall risk capital for a firm should be less than the total of the individual risk capitals 
of the underlying business units. That is because the correlation of returns between the 
business units is likely to be less than +1. Such risk reduction due to diversification effects 
over risk types and business activities is very difficult to measure in practice. Instead of using 
an extremely high overall confidence level for the firm, the various business units may use 
lower confidence levels to avoid an excessively high aggregate risk capital amount. 
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For example, assume a firm is subject to only the following four types of risk (risk capital 
amounts are provided for each risk): 

• Market risk = $400 

• Credit risk = $300 

• Liquidity risk = $200 

• Operational risk = $500 

Aggregate risk capital for the firm could be as high as $1,400 assuming a perfect correlation 
(i.e., sum of the four risk capital amounts). Or it could be as low as $734 assuming zero 
correlation (square root of the sum of squares of the four risk capital amounts). In taking 
into account the diversification effects, the firms overall VaR should be computed as some 
value between $734 and $1,400, which is a very wide range. In addition, there is a lot of 
subjectivity involved in allocating the diversification benefits back to the business units 
in a fair manner especially since the allocation will impact the respective business units’ 
performance measures (i.e., reduction of risk capital required). 

It makes sense that a business unit with earnings or cash flows that are highly correlated 
to the overall firm would need to be allocated more risk capital than a business unit with 
earnings or cash flows that are negatively correlated (assuming similar volatility). Having 
business lines that are countercyclical in nature allows the overall firm to have stable 
earnings and to attain a given desired credit rating using less risk capital. In practice, the 
easiest allocation method is a pro-rata allocation based on standalone risk capital amounts. 

For example, assume the following information pertaining to a business unit that engages in 
only two activities, A and B: 

• Activity A alone requires $50 of risk capital 

• Activity B alone requires $60 of risk capital 

• Activities A and B together require a total of $90 of risk capital 

Stand-alone capital looks at each activity independently and ignores any diversification 
benefits. Therefore, the stand-alone capital for Activities A and B are $50 and $60, 
respectively. The stand-alone capital for the business unit is $90. 

Fully diversified capital takes into consideration the diversification benefits, which equal 
$20 ($50 + $60 — $90). For simplicity, the diversification benefit can be done on a pro-rata 
basis as follows: ($20 x $50) / $110 = $9.1 is allocated to Activity A and ($20 x $60) /$! 10 
= $10.9 is allocated to Activity B. Therefore, Activities A and B have fully diversified capital 
of $40.9 and $48.1, respectively. Fully diversified capital should be used to determine a 
firm’s solvency and to determine the minimum amount of risk capital required for a given 
activity. 

Marginal capital is the extra capital needed as a result of a new activity added to the 
business unit. Diversification benefits are fully considered. The marginal risk capital for 
Activity A is $30 ($90 total - $60 for Activity B) and the marginal risk capital for Activity 
B is $40 ($90 total - $50 for Activity A). Total marginal risk capital ($70) is below the full 
risk capital of the business unit ($90). The general method for computing marginal capital 
of a new activity is to start with the total risk capital required for the business unit minus 
all of the risk capital required for the other activities. Marginal capital is useful for making 
active portfolio management and business mix decisions; such decisions need to fully 
consider diversification benefits. 
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In a performance measurement context, stand-alone risk capital is useful to determine 
incentive pay and fully diversified risk capital is useful to determine the incremental benefit 
due to diversification. In allocating the diversification benefits, caution must be taken 
especially since correlations between the risk factors usually change over time. In a more 
extreme situation such as a market crisis, correlations could move to -1 or +1, thereby 
reducing diversification benefits. 

RAROC Best Practices 


LO 48.8: Explain best practices in implementing an approach that uses RAROC to 
allocate economic capital. 


Recommendations for implementing a RAROC approach are as follows: 

Senior Management 

The management team (including the CEO) needs to be actively involved with the 
implementation of a RAROC approach within the firm and promote it as a means of 
measuring shareholder value creation. The emphasis should be on the level of profits earned 
by the firm in relation to the level of risks taken as opposed to merely earning as much 
profit as possible. 

Communication and Education 

The RAROC process needs to be clearly explained to all levels of management of the firm 
in order to have sufficient “buy in” from management. Specifically, the process of allocating 
economic capital to the various business units needs to be fair and transparent in order 
to minimize the common concerns of excessive economic capital attribution to a given 
business unit. An open dialogue and debate with the various business unit leaders of issues 
concerning how economic capital is computed would also be helpful. 

Ongoing Consultation 

There are key metrics that impact the computation of economic capital. A committee 
consisting of members from the various business units as well as the risk management 
group should review these metrics periodically in order to promote fairness in the capital 
allocation process. 

Metrics involving credit risk include: probability of default, credit migration frequencies, 
loss given default, and credit line usage given default. The metrics will change with time 
and will need to be updated accordingly. The historical period over which the metrics are 
adjusted is debatable—a shorter period may result in fluctuating economic capital amounts 
and a longer period may result in more stable amounts. 

Metrics involving market risk focus on volatility and correlation, and should be updated at 
least monthly. Metrics involving operational risk are not as defined as they are for credit and 
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market risk, so therefore, involve a significant amount of subjectivity and debate. Other key 
metrics, like core risk level and time to reduce, should be updated annually. 

Data Quality Control 

Information systems collect data (e.g., risk exposures and positions) required to perform 
the RAROC calculations. The data collection process should be centralized with built-in 
edit and reasonability checks to increase the accuracy of the data. In subdividing the general 
duties surrounding data, the RAROC team should be responsible for the data collection 
process, the computations, and the reporting. The business units and the accounting 
department should be responsible for putting controls in place to ensure the accuracy of the 
data being used for the RAROC calculations. 

Complement RAROC with Qualitative Factors 

A qualitative assessment of each business unit could be performed using a four-quadrant 
analysis. The horizontal axis would represent the expected RAROC return and the vertical 
axis would represent the quality of the earnings based on the importance of the business 
units activities to the overall firm, growth opportunities, long-run stability and volatility of 
earnings, and any synergies with other business units. There are four resulting possibilities: 

• Low quality of earnings, low quantity of earnings: the firm should try to correct, reduce, 
or shut down the activities of any of its business units in this category. 

• Low quality of earnings, high quantity of earnings (managed growth): the firm should 
maintain any business units that currently produce high returns but have low strategic 
importance to the firm. 

• High quality of earnings, low quantity of earnings (investment): the firm should 
maintain any business units that currently produce low returns but have high strategic 
value and high growth potential. 

• High quality of earnings, high quantity of earnings: the firm should allocate the most 
resources to business units in this category. 

Active Capital Management 

Business units should submit their limit requests (e.g., economic capital, leverage, liquidity, 
risk-weigh ted assets) quarterly to the RAROC team. The RAROC team performs the 
relevant analysis and sets the limits in a collaborative manner that allows business units to 
express any objections. Senior management will then make a final decision. The treasury 
group will ensure the limits make sense in the context of funding limits. The restriction 
placed on a firms growth due to leverage limitations helps promote the optimal use of the 
limited amount of capital available. 
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Key Concepts 


L0 48.1 

Risk capital is a buffer to shield a firm from the economic impacts of the risks that it 
takes (i.e., protect against unexpected losses). In short, it provides assurance to the firms 
stakeholders that their invested funds are safe. 

In most cases, risk capital and economic capital are identical; however, strategic risk capital 
may be added to economic capital as follows: 


economic capital = risk capital + strategic risk capital 


Regulatory capital is relevant only for regulated industries such as banking and insurance. It 
is computed using general benchmarks that apply to the industry. Assuming that risk capital 
and regulatory capital are the same for the overall firm, the amounts may be different within 
the various divisions of the firm. 

For financial institutions, there are four major reasons for using economic capital to allocate 
risk capital: 

• Capital is used extensively to cushion risk. 

• Financial institutions must be creditworthy. 

• Difficulty in providing an external assessment of a financial institutions creditworthiness. 

• Profitability is greatly impacted by the cost of capital. 


LO 48.2 

Benefits of using the risk-adjusted return on capital (RAROC) approach include: 

1. Performance measurement using economic profits instead of accounting profits. 

2. Use in computing increases in shareholder value as part of incentive compensation (e.g., 
scorecards) within the firm and its divisions. 

3. Use in portfolio management for buy and sell decisions and use in capital management 
in estimating the incremental value-added through a new investment or discontinuing 
an existing investment. 

4. Using risk-based pricing, which will allow proper pricing that takes into account the 
economic risks undertaken by a firm in a given transaction. 
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LO 48.3 


The basic RAROC equation is as follows: 


RAROC = 


after-tax expected risk-adjusted net income 
economic capital 


A more detailed RAROC equation for capital budgeting decisions is as follows: 

exp ected revenues — cos ts — exp ected losses 
— taxes + return on economic capital ± transfers 


RAROC = 


economic capital 


LO 48.4 

In computing RAROC, the focus is often on a one-year time horizon. However, it is 
possible to look at multi-period RAROC to obtain a more accurate RAROC measure for 
longer-term transactions and loans. One issue that arises is how much economic capital to 
allocate if the risk of a transaction changes dramatically in subsequent periods. There is a 
lot of subjectivity in selecting the time horizon for RAROC calculation purposes. A longer 
time horizon could be selected to account for the full business cycle, for example. A key 
consideration with the selection of a time horizon is the fact that risk and return data for 
periods over one year is likely to be of questionable reliability. 

A point-in-time (PIT) probability of default could be used for short-term expected losses 
and to price financial instruments with credit risk exposure. A through-the-cycle (TTC) 
probability of default is more commonly used for computations involving economic capital, 
profitability, and strategic decisions. 

In computing economic capital, the confidence level chosen must correspond with the 
firms desired credit rating. Choosing a lower confidence level will reduce the amount of risk 
capital required/allocated and it will impact risk-adjusted performance measures. 


LO 48.5 

The hurdle rate is computed as follows: 

^ |(CExRce) + (PExRpe)] 

oat = --:- 

(CE + PE) 

Once the hurdle rate and the RAROC are calculated, the following rules apply: 

• If RAROC > hurdle rate, there is value creation from the project and it should be 
accepted. 

• If RAROC < hurdle rate, there is value destruction from the project and it should be 
rejected/ discontinued. 
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LO 48.6 

RAROC should be adjusted to take into account systematic risk and a consistent hurdle rate 
as follows: 

Adjusted RAJROC = RAROC —13£ (Rjy[ ~ ^f) 


LO 48.7 

The overall risk capital for a firm should be less than the total of the individual risk capitals 
of the underlying business units. This is because the correlation of returns between business 
units is likely to be less than +1. 

A business unit with earnings or cash flows that are highly correlated to the overall firm 
should be allocated more risk capital than a business unit with earnings or cash flows 
that are negatively correlated (assuming similar volatility). Having business lines that are 
countercyclical in nature allows the overall firm to have stable earnings and to attain a given 
desired credit rating using less risk capital. 


LO 48.8 

The management team needs to be actively involved with the implementation of a RAROC 
approach within the firm and promote it as a means of measuring shareholder value 
creation. 

The RAROC process needs to be clearly explained to all levels of management of the firm 
in order to have sufficient “buy in” from management. 

A committee consisting of members from the various business units as well as the risk 
management group should periodically review the metrics that impact economic capital 
calculations in order to promote fairness in the capital allocation process. 

The RAROC team should be responsible for the data collection process, the computations, 
and the reporting. The business units and the accounting department should be responsible 
for putting controls in place to ensure the accuracy of the data being used for the RAROC 
calculations. 

A qualitative assessment of each business unit could be performed using a four-quadrant 
analysis. The horizontal axis would represent the expected RAROC return and the vertical 
axis would represent the quality of the earnings based on the importance of the business 
unit s activities to the overall firm, growth opportunities, long-run stability and volatility of 
earnings, and any synergies with other business units. 

Business units should submit their limit requests (e.g., economic capital, leverage, liquidity, 
risk-weighted assets) quarterly to the RAROC team. The RAROC team performs the 
relevant analysis and sets the limits in a collaborative manner that allows business units to 
express any objections. 
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Concept Checkers 


1. Which of the following statements regarding the risk-adjusted return on capital 
(RAROC) methodology is correct? 

A. In the context of performance measurement, RAROC uses accounting profits. 

B. In the numerator of the RAROC equation, expected loss is added to the return. 

C. If a business units cost of equity is greater than its RAROC, then the business 
unit is not adding value to shareholders. 

D. RAROC is useful for determining incentive compensation but it lacks the 
flexibility to consider deferred or contingent compensation. 

2. Assume the following information for a commercial loan portfolio: 

• $1.2 billion principal amount 

• 6% pre-tax expected return on loan portfolio 

• Direct annual operating costs of $8 million 

• Loan portfolio funded by $1.2 billion of retail deposits; interest rate = 4% 

• Expected loss on the portfolio is 0.4% of principal per annum 

• Unexpected loss of 7% of the principal amount 

• Risk-free rate on government securities is 1% 

• 30% effective tax rate 

• Assume no transfer pricing issues 

Based on the information provided, which of the following amounts is closest to the 
RAROC? 

A. 9.33% 

B. 10.03%. 

C. 12.33%. 

D. 14.66%. 

3. Which of the following statements regarding the computation of economic capital is 
correct? 

I. Selecting a longer time horizon for RAROC calculations is preferable because 
risk and return data is more reliable with more time. 

II. Choosing a lower confldence level will not likely reduce the amount of risk 
capital required if the firm has little exposure to operational, credit, and 
settlement risks. 

A. I only. 

B. II only. 

C. Both I and II. 

D. Neither I nor II. 
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4 Which of the following statements regarding the choice of default probability 

approaches in computing economic capital is correct? 

A. A through-the-cycle (TTC) approach should be used to price financial 
instruments with credit risk exposure. 

B. A point-in-time (PIT) approach is more commonly used for computations 
involving profitability and strategic decisions. 

C. A TTC approach is more likely to result in a lower volatility of capital compared 
to the PIT approach. 

D. A firms rating will not change when analyzed under the PIT approach versus the 
TTC approach. 

5. Which of the following statements regarding best practices in implementing a 

RAROC approach is correct? 

A. A successful RAROC approach is focused on maximizing profits earned by the 
firm. 

B. A restriction on the firms growth due to leverage limitations may result in 
higher profits. 

C. The data collection process throughout the firm should be decentralized to allow 
the various business units to ensure the utmost accuracy of data. 

D. Metrics involving credit risk, market risk, and operational risk to compute 
economic capital are generally clearly defined and may be computed objectively. 
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Concept Checker Answers 


1. C The cost of equity represents the minimum rate of return on equity required by shareholders. 

Therefore, if RAROC is below the cost of equity, then there is no value being added. 

Response A is not correct because RAROC uses economic profits, not accounting profits. 
Response B is not correct because in the numerator of the RAROC equation, expected loss 
is deducted from the return. Response D is not correct because RAROC has the flexibility to 
consider deferred or contingent compensation. 

2. B Unexpected loss ($1.2 billion x 7% = $84 million) is equal to the amount of economic 

capital required. The return on economic capital is then $84 million x 1% = $0.84 million. 
Also, expected revenues = 0.06 x $1.2 billion = $72 million; interest expense = 0.04 x $1.2 
billion = $48 million; expected losses = 0.004 x $1.2 billion = $4.8 million. 


RAROC = 


exp ected revenues — cos ts — exp ected losses 
— taxes + return on economic capital di transfers 

economic capital 


RAROC = (72-8-48-4.8 + 0.84 + 0)x(1-0.3) ^ 

84 


3. B Choosing a lower confidence level will not likely reduce the amount of risk capital required if 

the firm has little exposure to operational, credit, and settlement risks. The reduction would 
be much more dramatic only if the firm has significant exposure to such risks because large 
losses would be rare. 

In selecting a time horizon for RAROC calculations, risk and return data for periods over 
one year is likely to be of questionable reliability. 

4. C A firms rating is more likely to change when analyzed under the point-in-time (PIT) 

approach compared to the through-the-cycle (TTC) approach. As a result, the TTC 
approach results in a lower volatility of economic capital compared to the PIT approach. 

A PIT approach should be used to price financial instruments with credit risk exposure 
and to compute short-term expected losses. A TTC approach is more commonly used for 
computations involving profitability, strategic decisions, and economic capital. 

5. B A restriction on the firms growth due to leverage limitations may result in higher profits 

because it requires the firm to be “creative” and to optimize a scarce resource (the limited 
amount of capital available). 

Response A is not correct. A successful RAROC approach is focused on the level of profits 
earned by the firm in relation to the level of risks taken. Response C is not correct. The data 
collection process should be the responsibility of the RAROC team; the process should be 
centralized with built-in edit and reasonability checks to increase the accuracy of the data. 
Response D is not correct. Metrics involving operational risk are not as defined as credit 
and market risk, therefore, there is often a significant amount of subjectivity involved in the 
computations. 
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The following is a review of the Operational and Integrated Risk Management principles designed to address 
the learning ohjectives set forth hy GARP®. This topic is also covered in: 


Range of Practices and Issues in 
Economic Capital Frameworks 


Topic 49 

Exam Focus 

This topic requires an understanding of many risk management concepts that you have 
already covered at FRM Part I, as well as in earlier readings in the FRM Part II curriculum. 
Specifically, this topic expands on the concept of economic capital, which is the capital 
required to absorb unexpected losses for a given time horizon and confidence interval. For 
the exam, pay attention to the terminology and attempt to integrate this material to the 
sections pertaining to market risk and credit risk so as to reinforce your understanding. 


Economic Capital Implementation Framework 


LO 49.1: Within the economic capital implementation framework describe the 
challenges that appear in: 

• Defining and calculating risk measures 

• Risk aggregation 

• Validation of models 

• Dependency modeling in credit risk 

• Evaluating counterparty credit risk 

• Assessing interest rate risk in the banking book 


For this LO, it would be helpful to recall the properties of a coherent risk measure from the 
Part I curriculum. The properties are as follows: 

1. Monotonicity: A portfolio with greater future returns will likely have less risk. 

2. Subadditivity: The risk of a portfolio is at most equal to the risk of the assets within the 
portfolio. 

3. Positive homogeneity: The size of a portfolio will impact the size of its risk. 

4. Translation invariance: The risk of a portfolio is dependent on the assets within the 
portfolio. 

Defining and Calculating Risk Measures 

It is not always apparent how risk should be quantified for a given bank, especially when 
there are many different possible risk measures to consider. Prior to defining specific 
measures, one should be aware of the general characteristics of ideal risk measures. They 
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should be: intuitive, stable, easy to compute, easy to understand, coherent, and interpretable 
in economic terms. In addition, the risk decomposition process must be simple and 
meaningful for a given risk measure. 

Standard deviation, value at risk (VaR), expected shortfall (ES), as well as spectral 
(i.e., coherent) and distorted risk measures could be considered, each with their 
respective pros and cons. Obviously, no one measure would perfectly consider all of the 
necessary elements in measuring risk. In practice, VaR and ES are the most commonly 
used measures. The following section is a summary of challenges encountered when 
considering the appropriateness of each risk measure. 

Standard deviation 

• Not stable because it depends on assumptions about the loss distribution. 

• Not coherent because it violates the monotonicity condition. 

• Simple, but not very meaningful in the risk decomposition process. 

VaR (the most commonly used measure) 

• Not stable because it depends on assumptions about the loss distribution. 

• Not coherent because it violates the subadditivity condition (could cause problems in 
internal capital allocation and limit setting for sub-portfolios). 

Expected shortfall 

• May or may not be stable, depending on the loss distribution. 

• Not easy to interpret, and the link to the banks desired target rating is not clear. 

Spectral and distorted risk measures 

• Not intuitive nor easily understood (and rarely used in practice). 

• May or may not be stable, depending on the loss distribution. 

In defining or using such risk measures, banks often consider several of them and for 
different purposes. For example, absolute risk and capital allocation within the bank 
are most commonly measured using VaR, but increasingly, the latter is being measured 
using ES. The VaR measure of absolute risk tends to be easier to communicate to senior 
management than ES, but ES is a more stable measure than VaR for allocating total 
portfolio capital. The challenge for the bank is to determine if and when one or the other, 
or both, should be used. 

Amongst the commonly used measures to calculate economic capital, regulators do not have 
a clear preference for one over another. If different risk measures are implemented by a bank 
for external versus internal purposes, then there must be a logical connection between the 
two risk measures. For regulators, merely comparing a banks internal and regulatory capital 
amounts is insufficient when determining the underlying risks in its portfolio. Therefore, 
such a task presents an analytical challenge to regulators. 
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Risk Aggregation 

Risk aggregation involves identifying the individual risk types and making certain choices 
in aggregating those risk types. Classification by risk types (market, credit, operational, and 
business) may be approximate and prone to error. For example, the definitions of risk types 
may differ across banks or within a given bank, which complicates the aggregation process. 

Even though one or more of the previously mentioned four risk types may be found at the 
same time within a given bank portfolio, the portfolio will often be represented by one 
risk type for the banks classifications purposes. Such a simplistic distinction may result in 
inaccurate measurements of the risk types and this may bias the aggregation process. 

Most banks begin by aggregating risk into silos by risk-type across the entire bank. Other 
banks prefer using business unit silos, while others combine both approaches. There is no 
one unanimously accepted method, as each approach has its specific advantages. 

Before risk types can be aggregated into a single measure, they must be expressed in 
comparable units. There are three items to consider: risk metric, confidence level, and time 
horizon. 

1. Risk metric: Relies on the metrics used in the quantification of different risk types. 
Must consider whether the metric satisfies the subadditivity condition. 

2. Confidence level: Loss distributions for different types of risk are assumed to 
have different shapes, which implies differences in confidence intervals. The lack 
of consistency in choosing confidence levels creates additional complexity in the 
aggregation process. 

3. Time horizon: Choosing the risk measurement time horizon is one of the most 
challenging tasks in risk measurement. For example, combining risk measures that have 
been determined using different time horizons creates problems irrespective of actual 
measurement methods used. Specifically, there will be inaccurate comparisons between 
risk types. 

A common belief is that combining two portfolios will result in lower risk per investment 
unit in the combined portfolio versus the weighted average of the two separate portfolios. 
However, when we consider risk aggregations across different portfolios or business 
units, such a belief does not hold up with VaR because it does not necessarily satisfy the 
subadditivity condition. Also, there may be a false assumption that covariance always fully 
takes into account the dependencies between risks. Specifically, there could be times where 
the risk interactions are such that the resulting combinations represent higher, not lower, 
risk. These points highlight an additional challenge in the computation of risk. 

There are five commonly used aggregation methodologies. The following is a brief 
description of them, as well as the challenges associated with using them. 

1. Simple summation 

• Adding together individual capital components. 
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• Does not differentiate between risk types and therefore assumes equal weighting. 

Also, does not take into account the underlying interactions between risk types 
or for differences in the way the risk types may create diversification benefits. In 
addition, complications arising from using different confidence levels are ignored. 

2. Constant diversification 

• Same process as simple summation except that it subtracts a fixed diversification 
percentage from the overall amount. 

• Similar challenges as simple summation. 

3. Variance-covariance matrix 

• Summarizes the interdependencies across risk types and provides a flexible 
framework for recognizing diversification benefits. 

• Estimates of inter-risk correlations (a bank-specific characteristic) are difficult and 
costly to obtain, and the matrix does not adequately capture non-linearities and 
skewed distributions. 

4. Copulas 

• Combines marginal probability distributions into a joint probability distribution 
through copula functions. 

• More demanding input requirements and parameterization is very difficult to 
validate. In addition, building a joint distribution is very difficult. 

5. Full modeling/simulation 

• Simulate the impact of common risk drivers on all risk types and construct the joint 
distribution of losses. 

• The most demanding method in terms of required inputs. Also, there are high 
information technology demands, the process is time consuming, and it may provide 
a false sense of security. 

The variance-covariance approach is commonly used by banks. Frequently, however, bank- 
specific data is not available or is of poor quality. As a result, the items in the variance- 
covariance matrix are completed on the basis of expert judgment. On a related note, banks 
often use a “conservative” variance-covariance matrix where the correlations are reported to 
be approximate and biased upward. In order to reduce the need for expert judgment, banks 
may end up limiting the dimensionality of the matrix and aggregating risk categories so 
that there are only a few of them, not recognizing that such aggregations embed correlation 
assumptions. Clearly, a disadvantage of such a practice is that each category becomes less 
homogenous and therefore, more challenging to quantify. 

One potential disadvantage of the more sophisticated methodologies is that they often lead 
to greater confidence in the accuracy of the output. It is important to consider robustness 
checks and estimates of specification and measurement error so as to prevent misleading 
results. 

Validation of Models 

Validation is the “proof” that a model works as intended. As an example, while it is a useful 
tool to test a models risk sensitivity, it is less useful for testing the accuracy of high quantiles 
in a loss distribution. 
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The validation of economic capital models differs from the valuation of an IRB (internal- 
ratings based) model because the output of economic capital models is a distribution rather 
than a single predicted forecast against which actual outcomes may be compared. Also, 
economic capital models are quite similar to VaR models despite the longer time horizons, 
higher confidence levels, and greater lack of data. 

There are six qualitative validation processes to consider. The following is a brief description 
of them, as well as the challenges associated with using them (where applicable). 

1. Use test 

• If a bank uses its measurement systems for internal purposes, then regulators could 
place more reliance on the outputs for regulatory capital. 

• The challenge is for regulators to obtain a detailed understanding of which models 
properties are being used and which are not. 

2. Qualitative review 

• Must examine documentation and development work, have discussions with the 
models developers, test and derive algorithms, and compare with other practices and 
known information. 

• The challenge is to ensure that the model works in theory and takes into account the 
correct risk drivers. Also, confirmation of the accuracy of the mathematics behind 
the model is necessary. 

3. Systems implementation 

• For example, user acceptance testing and checking of code should be done prior to 
implementation to ensure implementation of the model is done properly. 

4. Management oversight 

• It is necessary to have involvement of senior management in examining the output 
data from the model and knowing how to use the data to make business decisions. 

• The challenge is ensuring that senior management is aware of how the model is used 
and how the model outputs are interpreted. 

5. Data quality checks 

• Processes to ensure completeness, accuracy, and relevance of data used in the 
model. Examples include: qualitative review, identifying errors, and verification of 
transaction data. 

6. Examination of assumptions—sensitivity testing 

• Assumptions include: correlations, recovery rates, and shape of tail distributions. 

The process involves reviewing the assumptions and examining the impact on model 
outputs. 

There are also six quantitative validation processes to consider. The following is a brief 
description of them, as well as the challenges associated with using them (where applicable). 

1. Validation of inputs and parameters 

• Validating input parameters for economic capital models requires validation of those 
parameters not included in the IRB approach, such as correlations. 
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• The challenge is that checking model inputs is not likely to be fully effective because 
every model is based on underlying assumptions. Therefore, the more complex the 
model, the more likely there will be model error. Simply examining input parameters 
will not prevent the problem. 

2. Model replication 

• Attempts to replicate the model results obtained by the bank. 

• The challenge is that the process is rarely enough to validate models and in practice, 
there is little evidence of it being used by banks. Specifically, replication simply by 
re-running a set of algorithms to produce the same set of results is not considered 
enough model validation. 

3. Benchmarking and hypothetical portfolio testing 

• The process is commonly used and involves determining whether the model 
produces results comparable to a standard model or comparing models on a set of 
reference portfolios. 

• The challenge is that the process can only compare one model against another and 
may provide little comfort that the model reflects “reality.” All that the process is 
able to do is provide broad comparisons confirming that input parameters or model 
outputs are broadly comparable. 

4. Backtesting 

• Considers how well the model forecasts the distribution of outcomes—comparison 
of outcomes to forecasts. 

• The challenge is that the process can really only be used for models whose outputs 
can be characterized by a quantifiable metric with which to compare an outcome. 

Obviously, there will be risk measurement systems whose outputs cannot be 
interpreted this way. Also, backtesting is not yet a major part of banks’ validation 
practices for economic purposes. 

5. Profit and loss attribution 

• Involves regular analysis of profit and loss—comparison between causes of actual 
profit and loss versus the model’s risk drivers. 

• The challenge is that the process is not widely used except for market risk pricing 
models. 

6. Stress testing 

• Involves stressing the model and comparing model outputs to stress losses. 

Overall, although these validation processes may be highly effective in areas such as risk 
sensitivity, they may not be effective in areas such as overall absolute accuracy. 

Additionally, there is difficulty in validating the conceptual soundness of a capital model. 

The development of a model almost always requires assumptions to be made. However, 
some of the assumptions may not be testable, so it could be impossible to be absolutely 
certain of the conceptual soundness of a model. Even though the underlying points may 
appear reasonable and logical, that may not be the case in practice. 

From a regulator’s perspective, some industry validation practices are weak, especially 
for total capital adequacy of the bank and the overall calibration of models. Such a 
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validation project is challenging because it usually requires evaluation of high quantiles of 
loss distributions over long periods of time. In addition, there are data scarcity problems 
plus technical difficulties, such as tail estimation. Therefore, it is important for senior 
management and model users to understand the limitations of models and the risks of using 
models that have not been fully validated. 

Dependency Modeling in Credit Risk 

Modeling the dependency structure between borrowers is crucial, yet challenging. Both 
linear and nonlinear dependency relationships between obligors need to be considered. 

In general, dependencies can be modeled using: credit risk portfolio models, models using 
copulas, and models based on the asymptotic single-risk factor (ASRF) model. With the 
ASRF approach, banks may use their own estimates of correlations or may use multiple 
systematic risk factors to address concentrations. Such an approach would result in 
questioning the method used to calibrate the correlations and the ways in which the bank 
addressed the infinite granularity and single-factor structure of the ASRF model. ASRF can 
be used to compute the capital requirement for credit risk under the IRB framework. 

There are many issues to consider regarding the challenges in coming up with reliable 
dependency assumptions used in credit risk portfolio models. Regulators may need to test 
the accuracy and strength of correlation estimates used by banks given their heavy reliance 
on model assumptions and the significant impact on economic capital calculations. 

In the past, the validity of the following assumptions have been questioned: (1) the ASRF 
Gaussian copula approach, (2) the normal distribution for the variables driving default, 

(3) the stability of correlations over time, and (4) the joint assumptions of correctly 
specified default probabilities and doubly-stochastic processes, which suggest that default 
correlation is sufficiently captured by common risk factors. 

Doubts have been raised about the ability of some models using such assumptions in terms 
of their ability to explain the time-clustering of defaults that is seen in certain markets. 
Insufficiently integrating the correlation between probability of default (PD) and loss 
given default (LGD) in the models, coupled with insufficiently modeling LGD variability, 
may lead to underestimating the necessary economic capital. Furthermore, it will create 
challenges in identifying the different sources of correlations and the clustering of defaults 
and losses. 

Rating changes are greatly impacted by the business cycle and are explained by different 
models during expansionary and recessionary periods. As a result, the sample period and 
approach used to calibrate the dependency structure could be important in assessing 
whether correlation estimates are overestimated or underestimated. Furthermore, some 
models assume that unobservable asset returns may be approximated by changes in equity 
prices but fail to consider that the relationship between asset returns and equity prices are 
unobservable and may be non-linear. Also, the use of equity prices to estimate credit default 
probability is problematic because such prices may include information that is irrelevant for 
credit risk purposes. As a result, using equity prices may result in some inaccuracy in the 
correlation estimates. 
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In contrast, when banks use a regulatory-type approach, the assumptions of such an 
approach create other challenges for both banks and regulators: 

• Correlation estimates need to be estimated, but there may be limited historical data 
on which to base the correlation estimates. Also, the assumptions used to generate the 
correlations may not be consistent with the underlying assumptions of the Basel II credit 
risk model. 

• A banks use of the Basel II risk weight model requires concentration risk to be accounted 
for by other measures and/or management methods. It will also require regulators to 
evaluate such measures/methods. 

A key challenge to overcome is the use of misspecified or incorrectly calibrated correlations 
and the use of a normal distribution (which does not replicate the details of the distribution 
of asset returns). This may lead to large errors in measuring portfolio credit risk and 
economic capital. 

Evaluating Counterparty Credit Risk 

Such a task is a significant challenge because it requires: obtaining data from multiple 
systems, measuring exposures from an enormous number of transactions (including many 
that exhibit optionality) spanning a wide range of time periods, monitoring collateral and 
netting arrangements, and categorizing exposures across many counterparties. As a result, 
banks need to have well-developed processes and trained staff to deal with these challenges. 

Market-risk-related challenges to counterparty exposure at default (EAD) estimation. 

• Counterparty credit exposure requires simulation of market risk factors and the 
revaluation of counterparty positions under simulated risk factor shocks, similar to VaR 
models. Consider the following two challenges that occur when attempting to use VaR 
model technology to measure counterparty credit exposure. 

♦ Market risk VaR models combine all positions in a portfolio into a single simulation. 

Therefore, gains from one position may fully offset the losses in another position in 
the same simulation run. However, counterparty credit risk exposure measurement 
does not allow netting across counterparties. As a result, it is necessary to compute 
amounts at the netting set level (on each set of transactions that form the basis of a 
legally enforceable netting agreement), which increases computational complexity. 

♦ Market risk VaR calculations are usually performed for a single short-term holding 
period. However, counterparty credit exposure measurement must be performed 
for multiple holding periods into the future. Therefore, market risk factors need 
to be simulated over much longer time periods than in VaR calculations, and the 
revaluation of the potential exposure in the future must be done for the entire 
portfolio at certain points in the future. 

Credit-risk-related challenges to PD and LCD estimation. 

• Some material transactions are performed with counterparties with which the bank does 
not have any other exposures. Therefore, the bank must calculate a probability of default 
(PD) and loss given default (LGD) for the counterparty and transaction. 

• For hedge funds, the measurement challenge occurs when there is little information 
provided on underlying fund volatility, leverage, or types of investment strategies 
employed. 

• Even for counterparties with which the bank has other credit exposures, the bank still 
needs to calculate a specific LGD for the transaction. 
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Interaction between market risk and credit risk — wrong-way risk. 

• Identifying and accounting for wrong-way risk (exposures that are negatively correlated 
with the counterparty’s credit quality) is a significant challenge because it requires an 
understanding of the market risk factors to which the counterparty is exposed. That 
would be difficult to do in the case of a hedge fund, for example, which would be less 
transparent. 

• It also requires a comparison of those factor sensitivities to the factor sensitivities of the 
banks own exposures to the counterparty. 

• The magnitude of wrong-way risk is difficult to quantify in an economic capital model 
since it requires a long time horizon at a high confidence level. 

Operational-risk-related challenges in managing counterparty credit risk. 

• The challenge is that managing such risk requires specialized computer systems and 
people. Complicated transactions, such as daily limit monitoring, marking-to-market, 
collateral management, and intraday liquidity and credit extensions, increase the risk of 
measurement errors. 

• The quantification of operational risks is a significant challenge, especially when it 
pertains to new or rapidly growing businesses, new products or processes, intraday 
extensions of credit, and infrequently occurring but severe events. 

Dijferences in risk profiles between margined and non-margined counterparties. 

• The modeling difference between the two types of counterparties is primarily concerned 
with the future forecasting period. For margined counterparties, the forecasting period is 
short, and for non-margined counterparties, it is usually much longer. 

• As a result of the difference in time periods, the aggregation of risk between these two 
types of counterparties is a challenge because the usual procedure is to use a single time 
period for all positions. 

Aggregation challenges. 

• In general, the challenges are increased significantly when moving from measuring credit 
risk of one counterparty to measuring credit risk of the firm in general for economic 
capital purposes. 

• When counterparties have both derivatives and securities financing activities, the 
problem is especially challenging because the systems in place may not be able to handle 
such aggregation. 

• Further aggregation challenges exist when high-level credit risk measures are required 
to be aggregated with high-level market risk and operational risk measures in order to 
calculate economic capital. 

• Breaking down counterparty credit risk into detailed component parts (as is often 
done with market risk) is another challenge. The sheer computational complexities and 
enormous amounts of data required would generally be cost prohibitive to perform on a 
frequent basis. The challenge still remains for many banks due to outdated or ineffective 
computer systems. 
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Assessing Interest Rate Risk in the Banking Book 

The computation challenge arises from the long holding period assumed for a banks 
balance sheet and the need to model indeterminate cash flows on both the asset and liability 
side due to the embedded optionality of many banking book items. 

Optionality in the banking book. 

• A major measurement challenge is found with non-linear risk from long-term fixed- 
income obligations with embedded options for the borrower to prepay and from 
embedded options in non-maturity deposits. 

• In considering the asset side of the balance sheet, prepayment risk options 

(i.e., mortgages, mortgage-backed securities, and consumer loans) are the main form of 
embedded options. The prepayment option results in uncertain cash flows and makes 
interest rate risk measurement a difficult task. 

• In considering the liability side, there are two embedded options in non-maturity 
deposits: (1) the bank has an option to determine the interest rate paid to depositors 
and when to amend the rate, and (2) the depositor has the option to withdraw up to the 
entire balance with no penalty. The interaction between these two embedded options 
creates significant valuation and interest rate sensitivity measurement problems. 

• Sufficiently modeling optionality exposures requires very complex stochastic-path 
evaluation techniques. 

Banks pricing behavior. 

• This factor contributes to the challenges in measuring the interest rate risk of banking 
book items. For example, it would require a model to analyze the persistence of the many 
different non-maturity banking products, as well as a model to determine bank interest 
rates that consider general market conditions, customer relationships, bank commercial 
power, and optimal commercial policies. 

• Determining bank interest rates would require the pricing of credit risk. The price 
of credit risk applied to different banking products creates a challenge because it 
would require a pricing rule that links the credit spread to changes in macroeconomic 
conditions and interest rate changes. Also, it means that interest rate stress scenarios 
should consider the dependence between interest rate and credit risk factors. 

The choice of stress scenarios. 

• The drawbacks of using simple interest rate shocks pose interest rate measurement 
challenges because the shocks: 

♦ Are not based on probabilities and, therefore, are difficult to integrate into economic 
capital models based on VaR. 

♦ Are not necessarily sensitive to the current rate or economic environment. 

♦ Do not take into account changes in the slope or curvature of the yield curve. 

♦ Do not allow for an integrated analysis of interest rate and credit risks on banking 
book items. 
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BIS Recommendations for Supervisors 


LO 49.2: Describe the BIS recommendations that supervisors should consider to 
make effective use of internal risk measures, such as economic capital, that are not 
designed for regulatory purposes. 


There are ten Bank for International Settlements (BIS) recommendations to consider: 

1. Use of economic capital models in assessing capital adequacy. The bank should show 
how such models are used in the corporate decision-making process so as to assess 

the models impact on which risks the bank chooses to accept. In addition, the board 
should have a basic understanding of the difference between gross (stand alone) and net 
(diversified) enterprise-wide risk in assessing the banks net risk tolerance. 

2. Senior management. The economic capital processes absolutely require a significant 
commitment from senior management. They should understand its importance in the 
corporate planning process and should ensure that there is a strong infrastructure in 
place to support the processes. 

3. Transparency and integration into decision-making. Economic capital results need 
to be easy to trace and understand in order to be useful. Careful attention must be 
given to obtaining reliable estimates on an absolute basis in addition to developing the 
flexibility to conduct firm-wide stress testing. 

4. Risk identification. This is the crucial starting point in risk measurement. The risk 
measurement process must be very thorough to ensure that the proper risk drivers, 
positions, and exposures are taken into account in measuring economic capital. That 
will ensure that there is little variance between inherent (actual) and measured risk. For 
example, risks that are difficult to quantify should be considered through sensitivity 
analysis, stress testing, or scenario analysis. 

5. Risk measures. No given risk measure is perfect, and a bank must understand the 
strengths and weaknesses of its chosen risk measures. No one risk measure for economic 
capital is universally preferred. 

6. Risk aggregation. The reliability of the aggregation process is determined by the 
quality of the measurement risk components, plus the interrelationships between such 
risks. The aggregation process usually requires consistency in the risk measurement 
parameters. The aggregation methodologies used should mirror the banks business 
composition and risk profile. 

7. Validation. The validation process for economic capital models must be thorough 
and corroborating evidence from various tests must show that the model “works” as 
intended. In other words, within an agreed upon confidence interval and time period, 
the capital level determined must be enough to absorb the (unexpected) losses. 
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8. Dependency modeling in credit risk. Banks must consider the appropriateness of the 
dependency structures used within their credit portfolio. Specifically, credit models 
need to be assessed for their limitations, and such limitations need to be dealt with via 
appropriate supplementary risk management approaches, such as sensitivity or scenario 
analysis. 

9. Counterparty credit risk. There are trade-offs to be considered in deciding between 
the available methods of measuring counterparty credit risk. Additional methods, such 
as stress testing need to be used to help cover all exposures. Measuring such risk is 
complicated and challenging. Specifically, the aggregation process needs to be vetted 
prior to a bank having a big picture perspective of counterparty credit risk. 

10. Interest rate risk in the banking book. Specifically, financial instruments with 
embedded options need to be examined closely in order to control risk levels. Certainly, 
there are trade-offs between using earnings-based versus economic value-based models 
to measuring interest rate risk. For example, the former has aggregation problems 
because other risks are measured using economic value. Also, using economic value- 
based models could be inconsistent with business practices. 

Economic Capital Constraints and Opportunities 


LO 49.3: Explain benefits and impacts of using an economic capital framework 
within the following areas: 

• Credit portfolio management 

• Risk based pricing 

• Customer profitability analysis 

• Management incentives 


Credit Portfolio Management 

Constraints imposed: 

• Credit quality of each borrower is determined in a portfolio context, not on a stand¬ 
alone basis. 

• A loans incremental risk contribution is used to determine the concentration of the loan 
portfolio. 

Opportunities offered: 

• The process allows one to determine appropriate hedging strategies to use in reducing 
portfolio concentration. 

• Credit portfolio management becomes a means for protecting against risk deterioration. 
Risk-Based Pricing 

Constraints imposed: 

• Pricing decisions are based on expected risk-adjusted return on capital (RAROC), so 
deals will be rejected if they are lower than a specific RAROC. The proposed interest rate 
is determined by the amount of economic capital allocated to the deal. 
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• Pricing decisions include: (1) cost of funding, (2) expected loss, (3) allocated economic 
capital, and (4) additional return required by shareholders. Therefore, a minimum 
interest rate is determined that will increase shareholder value. 

Opportunities ojfered: 

• Can be used to maximize the banks profitability. For example, some pricing decisions 
may need to be overridden because certain customer relationships are more profitable 
(at a lower price/interest rate) or desirable from a reputational point of view. Of course, 
such overrides are not taken lightly and require upper management approval, as well as 
rigorous subsequent monitoring. 

Customer Profitability Analysis 

Constraints imposed: 

• The analysis is complicated in that many risks need to be aggregated at the customer 
level. 

• Customers need to be segmented in terms of ranges of (net) return per unit of risk; the 
underlying information is difficult to measure and allocate. 

Opportunities ojfered: 

• Assuming that the measurement obstacles have been overcome, the analysis can be easily 
used to determine unprofitable or only slightly profitable customers. Such customers 
could be dropped and economic capital allocated to the more profitable customers. 

• Economic capital is used in maximizing the risk-return trade-off (through relative risk- 
adjusted profitability analysis of customers). 

Management Incentives 

Constraints imposed: 

• Studies show that compensation schemes are a minor consideration in terms of the actual 
uses of economic capital measures at the business unit level. 

Opportunities ojfered: 

• It is suggested that management incentives is the issue that motivates bank managers to 
participate in the technical aspects of the economic capital allocation process. 

Best Practices and Concerns for Economic Capital Governance 


LO 49.4: Describe best practices and assess key concerns for the governance of an 
economic capital framework. 


The soundness of economic capital measures relies on strong controls and governance. 
Senior management is responsible for making sure these controls are in place and that 
governance covers the entire economic capital process. Adopting an economic capital 
framework will improve a banks capital adequacy, strategic planning, risk appetite 
documentation, and risk-adjusted performance measurement. In order for an economic 
capital framework to be effective it should include: 

• Strong controls for changing risk measurements. 

• Comprehensive documentation for measuring risk and allocation approaches. 
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• Policies for making sure economic capital practices follow outlined procedures. 

• View of how economic capital measures apply to daily business decisions. 

Best practices for the governance of an economic capital framework cover: 

1. Senior management commitment. The successful implementation of an economic capital 
framework depends on the involvement and experience of the senior management 
group. They are one of the main drivers for adopting this framework. 

2. The business unit involved and its level of expertise. Governance structures differ 
among banks. Some banks opt for a centralized approach where economic capital 
responsibilities are assigned to one function (e.g., Treasury), while others opt for a 
decentralized approach that shares responsibilities between functions (e.g., finance and 
risk functions). Each business unit within the bank will manage its risk in accordance 
with the amount of allocated capital. The responsibilities for allocating capital within 
business units will also vary among banks as will the flexibility to reallocate capital 
during the budgeting period. 

3. The timing of economic capital measurement and disclosures. Most banks will compute 
economic capital on either a monthly or quarterly basis. Pillar 3 of the Basel II Accord 
encourages the disclosure of information about how capital is allocated to risks. 

4. Policies and procedures for owning, developing, validating, and monitoring economic 
capital models. Formal policies and procedures encourage the consistent application of 
economic capital across the bank. The owner of the economic capital model will usually 
oversee the economic capital framework. 

Key concerns related to governance and the application of economic capital measures 

involve: 

1. Senior management commitment. The level of management buy-in contributes to 
the meaningfulness of the economic capital process. The senior management group 
must understand the importance of applying economic capital measures for strategic 
planning purposes. 

2. The role of stress testing. Many banks currently apply stress tests; however, using more 
integrating stress tests will allow banks to better assess the impact of a stress scenario on 
certain economic capital measures. 

3. Measuring risk on either an absolute or relative basis. Correctly interpreting economic 
capital as an estimate of risk depends on either measuring the absolute level of capital or 
measuring risk on a relative basis. Some issues within this measurement concern include 
assumptions regarding diversification and management involvement as well as how the 
economic model captures risks. 

4. Not using economic capital as the only measure that determines required capital. Most 
banks align economic capital with external credit ratings. Shareholders desire 
profitability via lower capital levels while rating agencies encourage solvency via higher 
capital levels. 
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5. Defining available capital resources. Currently, there is no definition for available capital 
among banks. Most banks adjust Tier 1 capital to determine available capital resources. 

6. Transparency of economic capital measures. Economic capital models are more useful for 
senior managers when they are transparent. Increased documentation will improve the 
validity of using the model when making business decisions. 
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Key Concepts 


L0 49.1 

A multitude of challenges exist within the economic capital framework that involve: 

(1) defining risk measures, (2) risk aggregation, (3) validation of models, (4) dependency 
modeling in credit risk, (5) evaluating counterparty credit risk, and (6) assessing interest rate 
risk in the banking book. 


LO 49.2 

There are ten BIS recommendations that supervisors should consider to make effective use 
of risk measures. 


LO 49.3 

A number of specific constraints imposed and opportunities offered by economic capital 
exist within the areas of credit portfolio management, risk based pricing, customer 
profitability analysis, and management incentives. 


LO 49.4 

Best practices for the governance of an economic capital framework cover: (1) senior 
management commitment, (2) the business unit involved and its level of expertise, (3) the 
timing of economic capital measurement and disclosures, and (4) policies and procedures 
for owning, developing, validating, and monitoring economic capital models. 

Key concerns related to governance and the application of economic capital measures 
involve: (1) senior management commitment, (2) the role of stress testing, (3) measuring 
risk on either an absolute or relative basis, (4) not using economic capital as the only 
measure that determines required capital, (5) defining available capital resources, and 
(6) transparency of economic capital measures. 
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Concept Checkers 


1. Which of the following risk measures is the least commonly used measure in the 
practice of risk management? 

A. Value at risk. 

B. Standard deviation. 

C. Expected shortfall. 

D. Spectral risk measures. 

2. WTiich of the following aggregation methodologies is characterized by great difficulty 
in validating parameterization and building a joint distribution? 

A. Copulas. 

B. Constant diversification. 

C. Variance-covariance matrix. 

D. Full modeling/simulation. 

3. Which of the following model validation processes is specifically characterized by the 
limitation that it provides little comfort that the model actually reflects reality? 

A. Backtesting. 

B. Benchmarking. 

C. Stress testing. 

D. Qualitative review. 

4. Which of the following categories of BIS recommendations specifically refers to the 
need to consider using additional methods, such as stress testing, to help cover all 
exposures? 

A. Risk aggregation. 

B. Counterparty credit risk. 

C. Dependency modeling in credit risk. 

D. Interest rate risk in the banking book. 

5. The use of which of the following items is meant more for protecting against risk 
deterioration? 

A. Risk based pricing. 

B. Management incentives. 

C. Credit portfolio management. 

D. Customer profitability analysis. 
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Concept Checker Answers 


1. D Spectral and distorted risk measures are the least used of the four measures and are mainly of 

academic interest only. 

2. A Copulas have two notable disadvantages: (1) parameterization is very difficult to validate, and 

(2) building a joint distribution is very difficult. 

3. B With benchmarking and hypothetical portfolio testing, the process has its limitations 

because it can only compare one model against another and may provide little comfort 
that the model actually reflects “reality.” All that the process is able to do is provide broad 
comparisons confirming that input parameters or model outputs are broadly comparable. 

4. B There are trade-offs to be considered when deciding between the available methods of 

measuring counterparty credit risk. Additional methods, such as stress testing, need to be 
used to help cover all exposures. 

5. C Credit portfolio management is used as a means to protect against risk deterioration. In 

contrast, risk based pricing is used to maximize the banks profitability; customer profitability 
analysis is used to determine unprofitable or only slightly profitable customers; and 
management incentives are used to motivate managers to participate in the technical aspects 
of the economic capital allocation process. 
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Practice 


Topic 50 

Exam Focus 

To protect the smooth functioning of bank holding companies (BHCs), the Federal 
Reserve s Capital Plan Rule requires BHCs to implement an ongoing internal capital plan for 
thoroughly assessing and enhancing their capital adequacy under stress scenarios on a firm¬ 
wide basis. For the exam, know the fundamental principles and key practices to develop and 
implement an effective internal control plan, including: risk identifications, model valuation 
and review, oversight and governance, contingency planning, stress testing and scenario 
designing, loss estimation and projections methodologies, and evaluating the impact of 
capital adequacy, including risk-weighted assets and balance sheet projections. 


Capital Plan Rule 


LO 50.1: Describe the Federal Reserves Capital Plan Rule and explain the seven 
principles of an effective capital adequacy process for bank holding companies 
(BHCs) subject to the Capital Plan Rule. 


Bank holding companies (BHCs) must have adequate and sufficient capital for their 
survival and growth. Capital provides a cushion against unexpected losses and allows BHCs 
to continue to operate. The failure of BHCs (i.e., liabilities exceed assets, resulting in 
negative capital) would most likely be a burden on taxpayers and deposit insurance funds. 
An effective and sound capital management policy is critical for the health of BHCs, as well 
as the smooth functioning and stability of the entire financial system. 

The Federal Reserve maintains its interest in survivability and smooth functioning BHCs 
through its Capital Plan Rule and the annual Comprehensive Capital Analysis and Review 
(CCAR). The CCAR is the Federal Reserves supervisory program for evaluating capital 
plans. 

The Capital Plan Rule mandates that BHCs develop and put in place a capital plan 
and a process to evaluate and monitor their capital adequacy. The capital plan covers all 
U.S. domiciled BHCs with total consolidated assets equal to $50 billion or more. 

The Capital Plan Rule lists the principles that the Federal Reserve uses to evaluate the 
adequacy and appropriateness of a BHCs internal capital planning processes and practices. 
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The principles on which the Federal Reserve assesses BHCs for managing and allocating 

their capital resources is referred to as the capital adequacy process (CAP). The seven 

principles of the CAP are as follows: 

1. Risk management foundation. A BHC has an effective capital risk management plan 
to encompass all key risk exposures on a firm-wide basis in terms of identification, 
evaluation, measurement, and control. 

2. Resource estimation methods. A BHC has a capital resource estimation plan to clearly 
define and estimate available capital resources over a stress scenario time horizon. 

3. Loss estimation methods. A BHC has a process for estimating potential losses and 
aggregating them on a firm-wide basis over a given stress scenario time horizon. 

4. Impact on capital adequacy. A BHC has a process to evaluate the combined impact on 
capital adequacy—given loss estimates and capital resources combined—in light of the 
stated goals with respect to capital level and composition. 

5. Capital planning policy. A BHC has a sound capital policy to develop capital goals, 
determine appropriate capital levels and composition as well as capital distributions 
(actions) and contingency plans. 

6. Internal controls. A BHC has a vigorous internal controls policy in place for 
independent review, model validation, documentation, and internal audit of the capital 
adequacy process. 

7. Effective oversight. A BHC has a board and senior management responsible for an 
effective and thorough oversight of multiple dimensions of the internal capital risk 
plan, including methods, processes, assessments, validations, reviews, documentation, 
infrastructure, resources, goals, limitations, and approval of capital decisions. 
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Capital Adequacy Process 


LO 50.2: Describe practices that can result in a strong and effective capital 
adequacy process for a BHC in the following areas: 

• Risk identification 

• Internal controls, including model review and valuation 

• Corporate governance 

• Capital policy, including setting of goals and targets and contingency planning 

• Stress testing and stress scenario design 

• Estimating losses, revenues, and expenses, including quantitative and 
qualitative methodologies 

• Assessing the impact of capital adequacy, including risk-weighted asset (RWA) 
and balance sheet projections 


For this LO, we detail the seven key practices that can result in a strong and effective capital 
adequacy process for a BHC. 

Risk Identification 

BHCs should have a process in place to identify all risk exposures stemming from numerous 
sources, including stress conditions, changing economic and financial environments, on- 
and-off balance sheet items, and their impact on capital adequacy. In addition, BHCs 
should critically scrutinize underlying assumptions regarding risk reduction through risk 
mitigation or risk transfer techniques. Senior management should regularly update and 
review the risk identification plan with special consideration for how their risk profiles 
might change under stress scenarios. Risk identification techniques should be able to detect 
the changes in the overall risk profile as well as the signs of capital inadequacy in the early 
stages. 

BHCs should integrate the identified risk exposures into their internal capital planning 
processes. Scenario-based stress testing may not capture all potential risks faced by 
BHCs, some risks are difficult to quantify or they do not fall into the integrated firm¬ 
wide scenarios. However, such risks must be included and accounted for in the capital 
planning processes. These risks are categorized as “other risks,” and their examples include 
compliance, reputational, and strategic risks. There are a variety of methods which BHCs 
can employ, including internal capital targets to incorporate such risks. 

Internal Controls 

An internal audit team should carefully scrutinize the internal control data for accuracy 
before submitting to senior management and the board. BHCs should have efficiently 
running management information systems (MIS) for collecting and analyzing pertinent 
information set quickly and accurately. 

In addition, BHCs should put in place a detailed and organized documentation system fully 
encompassing all dimensions of capital planning processes, including risk identification, loss 
estimation techniques, capital adequacy, and capital decision processes. 
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There must be a thorough, independent, and regular review and validation of all models 
used for internal capital planning purposes, including assessment of conceptual soundness 
of models and verification of processes. A validation team should have a required technical 
skill set as well as complete independence from all business areas of the BHC and model 
developers. Such independence is crucial for the validation team to offer an unbiased, 
independent, and valuable verdict. 

BHCs should maintain and update a list of all inputs, assumptions, and adjustments for 
the models used to generate final projections and estimates, such as income, loss expenses, 
and capital. These models should be validated for their effective use, not only under 
normal conditions, but also under stress conditions. BHCs should make full disclosure of 
their validation process and outcome, and should restrict the use of models which are not 
validated. 

Governance 

BHCs should have boards with sufficient expertise and involvement to fully understand and 
evaluate the information provided to them by senior management regarding their capital 
planning processes. The board should be furnished with comprehensive information with 
respect to risk exposures, loss estimates, determinants of revenues and losses, underlying 
models and assumptions, and weaknesses and strengths of capital planning processes. 

Also, the boards should be informed about the stress scenarios and any corrective measures 
undertaken as a result of stress testing outcomes. 

Under the Capital Plan Rule, the management of BHCs is required to furnish key 
information to the board for its approval of internal capital adequacy plans. Such 
information should include underlying assumptions and results of stress testing and the 
outcome of internal audits, as well as model review and validation checks. 

Senior management should evaluate the internal capital plan on an ongoing basis, focusing 
on key weaknesses, strengths, assumptions, scenarios, estimates, and models. In addition, 
senior management should make appropriate adjustments and remediation to the capital 
plan if the review process reveals shortcomings in the plan. 

BHCs should maintain detailed minutes of board meetings, describing the issues raised 
and discussed, as well as the information used and the recommendations made in these 
meetings. 

Capital Policy 

A capital policy should clearly define the principles and guidelines for capital goals, 
issuance, usage, and distributions. The policy should also fully spell out the details of 
the BHCs capital planning processes, including the decision rules of capital usage and 
distribution, financing, and other policies. The capital policy should focus on the unique 
needs and financial situation of BHCs while taking into consideration the supervisory 
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expectations. Policies regarding common stock dividends and repurchase agreements should 
include the following: 

• Key metrics influencing the size, timing, and form of capital distributions. 

• Materials used in making capital distribution decisions. 

• Specific scenarios that would cause a distribution to be reduced or suspended. 

• Situations that would cause the BHC to consider replacing common equity with other 
forms of capital. 

• Key roles and responsibilities of individuals or groups for producing reference materials, 
making distribution recommendations and decisions, and reviewing analysis. 

Capital goals developed by BHCs should be compatible with their risk tolerance, risk 
profile, regulatory requirements, and expectations of various stakeholders (e.g., shareholders, 
creditors, supervisors, and rating agencies). BHCs should establish specific goals for both 
the level and composition of capital under normal as well as stress conditions. Capital 
targets, which need to be set above the capital goals for capital adequacy under stress 
conditions, should take into consideration future economic outlooks, stress scenarios, and 
market conditions. 

While setting capital distribution levels, BHCs must take into consideration numerous 
factors, including future growth plans (including acquisitions) and associated risk, current 
and future general economic conditions, in particular the impact of macroeconomic and 
global events during stress conditions, on their capital adequacy. Capital distribution 
decisions must be connected to capital goals or capital adequacy requirements. 

BHCs should develop strong contingency planning offering numerous options to deal with 
contingency situations as well as their effectiveness under stress conditions. Contingency 
plans should be based on realistic assumptions and contain futuristic outlooks, rather than 
overly relying on history. Contingency actions should be feasible and realistic in the sense 
that they should be easy to implement when or if the contingency warrants. Capital triggers 
flagging the early warning of capital deterioration should be based on the projected results, 
regulatory requirements, and the expectations of various stakeholders, including creditors, 
shareholders, regulators, investors, and counterparties. 

Stress Testing and Stress Scenario Design 

Scenario design and stress testing should focus on unique situations of BHCs, their asset 
and liability mix, portfolio composition, business lines, geographical territory, and revenue 
and loss factors, while taking into consideration the impact of macroeconomic and firm- 
specific vulnerabilities and risks. That is, the stress test designing should go above and 
beyond the general guidelines established by the supervisory authority. Also, a BHCs 
scenario designing and testing should not employ optimistic assumptions benefiting the 
BHC. 

BHCs should employ both an internal model and expert judgment, an outside experts 
opinion. If only a third-party model is used, it must be tailored to the unique risk profile 
and business model of a BHC. The designed scenarios should assume a strong strain on the 
revenue and income of BHCs. 
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Stress testing models should be based on multiple variables encompassing all the risk 
exposures faced by BHCs on a firm-wide basis. For example, BHCs concentrated in a 
region, business, or industry should include relevant region, business, or industry-related 
variables. In addition, the scenarios should clearly spell out how they address specific risks 
faced by BHCs. The description should also provide explanations of how a scenario stresses 
specific BHC weaknesses and how variables are related to each other. 

Estimating Losses, Revenues, and Expenses 


Quantitative and Qualitative Basis 

BHCs should prefer using internal data to estimate losses, revenues, and expenses. However, 
in certain situations, it may be more appropriate to use external data. In these instances, it 
should be ensured that the external data reflects the underlying risk profile of their business 
lines, and necessary adjustments should be made to data input or output to make the 
analysis reflect a true picture of the BHCs unique characteristics. 

A range of quantitative methods are available to BHCs for estimating losses, revenues, and 
expenses. Regardless of which method they use, the final outcome should be identification 
of key risk factors and impact of changing macro and financial conditions under normal 
and stress conditions on a firm-wide basis. 

In addition, BHCs should segment their line of businesses and portfolios utilizing common 
risk characteristics showing marked differences in past performances. For example, a 
borrowers risk characteristics can be segmented by criteria such as credit score ranges. 
However, each risk segment should have sufficient data observations on losses, revenues, 
and expenses, (and underlying factors impacting losses, revenues, and expenses) in order to 
generate meaningful model estimates. 

Past relationships between losses, revenues, expenses, and underlying driving factors, and 
their interrelationships may not hold in the future, thus, necessitating employment of 
sensitivity analysis (to answer “what if” questions) when using models based on historical 
underlying interactions. 

BHCs sometimes use qualitative methodologies, like expert judgment or management 
overlay, as a substitute or a complement to quantitative methods. Qualitative techniques 
should be based on sound assumptions, and an external reviewer should find these 
approaches logical, reasonable, and clearly spelled out. A sensitivity analysis should be used 
for a qualitative approach as well. From a supervisory standpoint, BHCs are expected to 
use conservative assumptions, not favorable to BHCs, for estimating losses, revenues, and 
expenses under normal and stress conditions. 

Loss Estimation Methods 

BHCs should employ loss estimation methods, which offer theoretical soundness and 
empirical validity. In addition to using general macroeconomic explanatory variables, the 
loss estimation models should use specific variables exhibiting a direct link to particular 
exposures and portfolios. 
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BHCs should use uniform, reputable methods to aggregate losses across various lines of 
business and portfolios for firm-wide scenario analysis. They should also use automated 
processes, without manual intervention or managerial adjustments showing clear linkage 
from data sources to loss estimation and aggregation. For estimating retail loan losses, BHCs 
often use internal data, but for wholesale loss estimation, internal data is supplemented 
with external data. In the case using external data, BHCs should demonstrate that the data 
reflects their risk exposures, encompassing geographic, industry, and other key dimensions. 
Risk segmentation should be supported by the data capturing the unique characteristics of 
each risk pool. 

BHCs can use either an economic loss approach (i.e., expected losses) or an accounting- 
based loss approach (i.e., charge-off and recovery) to estimate credit losses. For the expected 
loss approach, BHCs should categorize losses into probability of default (PD), loss given 
default (LCD), or exposure at default (FAD) and then identify the determinants of each 
component. Long run averages for PDs, LCDs, and EADs should not be used, as these 
averages reflect economic downturn and upturn periods not necessarily suitable for scenario 
testing under stress conditions. LCD should be linked to underlying risk factors, such as a 
fall in the value of collateralized assets under stress conditions, and it should be estimated at 
some level of segmentation, such as lending product or type of collateral. EADs should be 
modeled to exhibit variation depending on changes in macroeconomic conditions. 

If BHCs are using rating systems as a key input to estimate expected losses under stress 
(e.g., on their wholesale portfolios), they should recognize the limitations in rating systems 
and their data and make necessary adjustments. 

BHCs should utilize a robust time series with sufficient granularity while employing role- 
rate models to estimate the rate at which delinquent and non-delinquent accounts in 
the current quarter are expected to roll over into default or delinquent status in the next 
quarter. 

If using charge-off models (i.e., accounting models), BHCs should include variables which 
represent the risk characteristics of an underlying portfolio while estimating the statistical 
relationship between charge-ofF rates and macroeconomic variables at the portfolio level. 

Operational Risk 

In order to determine operational risk, many BHCs estimate correlation between 
operational risk and macroeconomic factors. If they do not discover a statistically significant 
relationship between the variables, they employ other methods, including scenario analysis 
utilizing historical data and management input. BHCs should employ a combination of 
techniques to develop strong loss estimates under stress conditions, including past loss 
records, future expected events, macro conditions, and firm-specific risks. 

BHCs using regression models to estimate loss frequency and loss severity under stress 
scenarios should provide statistical support for the period chosen for estimation purposes 
instead of arbitrary and judgmental selection. 

A modified loss distribution approach (LDA) is also used by BHCs to estimate value at risk 
(VaR) to estimate operational risk losses at a chosen confidence interval (e.g., 90% or 95%). 
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To generate a strong and effective process, BHCs should offer a sound justification for their 
choice and perform a sensitivity analysis around the chosen interval. 

Some BHCs use scenario analyses in case they encounter model or data limitations in order 
to incorporate a wide range of risks (which is not possible otherwise due to data or model 
limitations). In such events, BHCs should provide a rationale for the chosen scenario in 
their loss estimation process. 

Market Risk and Counterparty Credit Risk 

BHCs, which are involved in trading, are subject to counterparty credit risk from changes 
in the value of risk exposure and creditworthiness of the counterparty due to changing 
macroeconomic conditions. 

In order to estimate the potential loss resulting from market credit interaction, BHCs use 
probabilistic approaches (which produce a probability distribution of expected portfolio 
losses) and deterministic approaches (which yield point estimates of an expected portfolio 
loss). 

BHCs using probabilistic approaches should clearly offer evidence that such methods can 
yield more severe risk scenarios compared to historical scenarios. BHCs should also explain 
how they utilize tail loss scenarios to detect and address firm-specific risks. 

BHCs using deterministic approaches should demonstrate that they have employed a wide 
range of scenarios, adequately covering their key risk exposures, including mark-to-market 
positions in the event of firm-specific or market-wide stress conditions. In addition, BHCs 
should clearly spell out the underlying assumptions employed in stress testing scenarios for 
risk measurement purposes and corrective measures to fix the identified deficiencies. 

Market shock scenarios do not directly incorporate the default of the counterparty. Some 
BHCs explicitly incorporate the scenario of default of key counterparties (including key 
customers) while using some sort of probabilistic approach involving some estimates of the 
PD, LCD, and EAD of counterparties. This method allows BHCs to focus exclusively on 
the defaults of counterparties to which BHCs have large risk exposure. 

BHCs also use assumptions about risk mitigation in the future. Such assumptions, if used, 
should be conservative in nature. In stress scenarios, the ability of BHCs to take desired 
actions may be limited. 

PPNR Projection Methodologies 

PPNR is pre-provision net revenue (i.e., net revenue before adjusting for loss provisions). 

While estimating revenues and expenses over a planning horizon under stressed conditions 
(the Capital Plan Rule requires forecasts over the next nine quarters), BHCs should not 
only take into consideration their current situation, but also the possible future paths of 
business activities and operational environments related to their on- and off-balance sheet 
risk exposures, underlying assumptions, and assets and liabilities. 
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BHCs should also take into consideration the impact of regulatory changes on their 
performance and ability to achieve their stated targets and goals. Projections should be 
based on coherent and clearly defined relationships among numerous, relevant variables, 
such as revenues, expenses, and balance sheet items within a given scenario. For example, 
assumptions related to origination should be the same for projections related to loans, fees, 
costs, and losses. 

Underlying assumptions for revenues, expenses, and loss estimates should be theoretically 
and empirically sound, and the central planning group as well as the corporate planning 
group should be engaged in aggregating projections on an enterprise-wide basis. In the case 
of limited data, BHCs should employ external data in conjunction with internal data. 

Net interest income projections are not isolated projections; rather, they are entrenched 
with other items of a capital adequacy plan. Balance sheet assumptions should be consistent 
while projecting net interest income. For example, balance sheet assumptions for projecting 
net interest income should be the same when estimating loss. Methods employed for 
projecting net interest income should incorporate ongoing changes in current and projected 
balance sheet positions. 

BHC projections under various scenarios, based on product characteristics (e.g., a change 
in deposit mix due to increased demand for time deposits), underlying assumptions, and 
rationale by product should be carefully explained. 

BHCs linking loss projections to net interest income projections should clearly establish this 
link while using modeling approaches, which incorporate the behavioral characteristics of 
the loan portfolio. 

Net interest income projections should be based on methodologies that incorporate 
discount or premium amortization adjustments for assets not held at par value that would 
materialize under different scenarios. 

New business pricing projections and underlying assumptions, such as constant add-ons 
to a designated index value, should be compatible with past data, scenario conditions, and 
BHCs balance sheet projections. 

BHCs should project non-interest income in light of stated scenarios and business 
strategies. Projection methods should fully encompass underlying major risk exposures and 
characteristics of a specific business line. For example, an asset management group should 
project non-interest income using various methods, including brokerage as well as money 
management revenues. 

Additionally, BHCs with trading portfolios should establish a clear link between trading 
revenue projections to trading assets and liabilities and the compatibility of all the elements 
of stress scenario conditions. 

BHCs with off-balance sheet business items should demonstrate the linkage between 
revenue projections and changes in on- and off-balance sheet items. 
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BHCs should not assume perfect correlation between revenues (generated from trading or 
private equity activity) and broad indices. BHCs should estimate the sensitivity coefficients 
for changes in revenue as a result of changes in broad index movements. 

Furthermore, BHCs holding mortgage servicing rights assets (MSRAs) should carefully 
design assumptions regarding default, prepayment, and delinquency rates, ensuring that 
these assumptions are robust and scenario specific. In addition, BHCs that hedge MSRA 
risk exposure should generate scenario specific assumptions. 

For BHCs, projecting volume increases in mortgage loans while ignoring market saturation 
or other key factors would be an ineffective and weak process, whereas consideration 
of individual business models, client profiles, and capacity constraint (while projecting 
mortgage loan volume) would be an effective and strong capital adequacy process. 

Macroeconomic relationships should be based on sound theoretical construct and supported 
by empirical evidence. For example, BHCs may experience a steep decline in credit card 
fee revenues in a strong recessionary period because of a decline in consumer spending. 

An example of a weaker practice of a capital planning process is if a BHC does not show a 
sufficient decline in revenue in stressed conditions despite obvious macro relationships. 

In addition, BHCs should utilize a wide set of explanatory variables to develop statistical 
relationships. BHCs should take into consideration the impact of macroeconomic 
conditions, such as an economic downturn, on their non-interest expense projections. Non¬ 
interest expense projections, like all other projections, should be consistent with revenue 
and balance sheet estimates and should generate the same underlying strategic assumptions. 
If projections assume that a decline in revenue (e.g., due to an increase in credit collection 
costs in an economic downturn) can be offset by some mitigating strategies, BHCs should 
then clearly demonstrate the feasibility of such actions. Mitigation actions should not be 
supported by past relationships and actions only because future financial, macro, and global 
environments may not be as favorable to execute such strategies, as was the case in the past. 

Estimation methods to project non-interest expense should focus on uncovering 
determinants (factors) of individual expense items and how sensitive those factors are to 
changing macro conditions and business strategies. 

Assessing the Impact of Capital Adequacy 

BHCs should have a well-defined and well-documented process of generating projections 
with respect to size and composition of on- and off-balance sheet items and risk-weighted 
assets (RWA) over a stress horizon period. 

Projecting balance sheet items, such as changes in assets and funding, directly without 
consideration of underlying drivers (of such changes), would be a weak practice. BHCs 
should identify the impact of changes in key factors on changes in asset and liabilities. 
Projections should take into consideration these vital relationships. 

BHCs should incorporate relationships between revenues, expenses, and balance sheet 
items into their scenario analyses. Projections about losses, revenues, expenses, and on- and 
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off-balance sheet items should not be based on favorable underlying assumptions. These 
assumptions may not stand the trial of uncertain market conditions under stress conditions. 

Projections for RWA should be consistent with the projections for risk exposures of on- 
and off-balance sheet items. All underlying assumptions used for balance sheet and RWA 
projections should be clearly documented and critically reviewed and validated. 

BHCs with a strong process of implementation should form a centralized group responsible 
for aggregating loss, revenue, expense, on- and off-balance sheets, and RWA projections for 
enterprise-wide scenario analysis. In addition, BHCs should establish a strong governance 
structure to critically scrutinize assumptions, methods, and estimates generated in an 
enterprise-wide scenario analysis and offer needed adjustments. BHCs should carefully 
evaluate the validity and relevance of underlying assumptions across business lines, 
portfolios, loss, expense, and revenue estimates if an enterprise-wide scenario analysis 
produces post-stress results that are more favorable than the baseline conditions. The 
outcomes of such analyses should also be reconciled for regulatory as well as management 
reporting purposes. 
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Key Concepts 


LO 50.1 

The Federal Reserve s Capital Plan Rule mandates all top-tier, U.S. domiciled bank holding 
companies with consolidated assets equal to or greater than $50 billion to develop and 
maintain an effective and robust internal capital plan for evaluating and assessing their 
capital adequacy. 

There are seven principles on which the Federal Reserve assesses the effectiveness of a BHC s 
internal capital planning, also known as the capital adequacy process (CAP). These seven 
principles are related to risk management foundation, resource and loss estimation methods, 
capital adequacy, capital planning and internal controls policies, and governance oversight. 


LO 50.2 

BHCs should develop a process to effectively identify all of their risk exposures on a firm¬ 
wide basis. BHCs should establish a mechanism for a comprehensive, independent, and 
regular review and validation of all the models used for capital adequacy planning purposes. 
BHCs should have boards actively involved in evaluating and approving their internal 
capital adequacy plans. BHCs should develop a capital policy that clearly defines the 
principles and guidelines for capital goals, issuance, usage, and distributions. 

Stress testing and stress scenario design should be based on a variety of factors encompassing 
all the risk exposures faced by BHCs on a firm-wide basis. With the option of utilizing 
various quantitative and qualitative methods, BHCs should carefully identify key risk 
exposures on a firm-wide scenario basis. BHCs should use loss estimation methodologies, 
which are based on sound theoretical and empirical foundations. BHCs should use a 
combination of inputs in order to develop loss estimates arising from operational risk. 

In order to estimate the counterparty credit risk, BHCs mostly use probabilistic or 
deterministic approaches. BHCs using a probabilistic approach should offer evidence 
of generating probable scenarios stronger than past observed events. BHCs using a 
deterministic approach should generate a wide range of stress scenarios. 

While estimating pro-provision net revenue (PPNR) projection methodologies, BHCs 
should pay particular attention to interrelationships among numerous relevant variables 
such as revenues, expenses, and on- and off-balance sheet items within a given scenario. 
Methodologies used for projecting net interest income should incorporate ongoing, current, 
and projected balance sheet positions. BHCs should project non-interest income in light of 
stated risk scenarios and business strategies. 

BHCs should have a well-defined process in place to develop projections of revenues, 
expenses, losses, on- and off-balance sheet items, and risk-weighted assets in an enterprise¬ 
wide scenario analysis. Projections should be based on sound underlying assumptions, 
interactions, and factors (main drivers of change), and the estimates should be scrutinized, 
documented, and reported. 
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Concept Checkers 


1. The seven principles of an effective capital adequacy process for bank holding 
companies (BHCs) subject to the Capital Plan Rule include which of the following? 

I. Oversight from peer BHCs 

II. Annual reporting to the stock exchange (where their stock is listed) 

A. I only 

B. II only. 

C. Both I and II. 

D. Neither I nor II. 

2. The Federal Reserves Capital Plan Rule requires BHCs to maintain an effective 
process for assessing their capital adequacy for: 

A. BHCs, U.S. or non-U.S. domiciled. 

B. BHCs with more than five years of operational history. 

C. BHCs with a net annual income of more than $5 billion. 

D. BHCs with total consolidated assets of $50 billion or greater. 

3. How many of the following statements is most likely correct? BHCs should have risk 
identification processes that evaluate: 

I. On- and off-balance sheet positions. 

II. Risk transfer and/or risk mitigation techniques. 

III. Changes in institutions’ risk profile due to portfolio quality. 

IV. Reputational risk. 

A. One statement. 

B. Two statements. 

C. Three statements. 

D. Four statements. 

4. Which of the following statements is most likely correct? 

A. The internal controls policy of BHCs requires that senior management should 
furnish the board of directors with sufficient information to comprehend the 
BHC risk exposures. 

B. A governance policy offers fundamental guidelines and principles to BHCs for 
the capital issuance, use, distribution, and planning purposes. 

C. Suspension or reduction in dividends or repurchase programs do not fall under 
the capital policy of BHCs. 

D. Designing and testing a scenario-related default of a major counterparty is an 
example of BHC stress testing and a stress scenario design policy. 

5. Which of the following statements is most likely correct? 

I. Under the expected losses methodologies, loss estimation involves three 
elements: probability of default, loss given default, and exposure at default. 

II. Net interest income projections should incorporate changing conditions for 
balance sheet positions, including embedded options, prepayment rates, loan 
performance, and re-pricing rates. 

A. I only. 

B. II only. 

C. Both I and II. 

D. Neither I nor II. 
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Concept Checker Answers 


1. D Oversight from peer BHCs and annual reporting to the stock exchange are not included in 

the seven principles of an effective capital adequacy process. 

2. D BHCs with total consolidated assets of $50 billion or greater. The other answers are not part 

of the requirements under the Capital Plan Rule. 

3. D All of the statements are correct. BHCs should have risk identification processes effectively 

identifying all risk exposures for assessing capital needs. Reputational risk, like strategic 
risk and compliance risk, falls under the category of “other risks” and are more difficult to 
quantify. Nevertheless, there are a wide range of methods BHCs employ to evaluate other 
risks. 

4. D The first statement is the requirement of the governance policy and not the internal control 

policy. The second statement falls under capital policy and not the governance policy. 
Regarding the third statement, capital contingency plans (e.g., suspension or reduction in 
dividends or repurchase programs) are a key part of capital policies of BHCs detailing the 
actions intended to be taken under deficiencies in capital position. The fourth statement is 
correct. Many different scenarios, including counterparty default, fall under the BHCs’ stress 
testing and scenario design policy. 

5. C Both statements are correct. Loss estimation involves probability of default, loss given 

default, and exposure at default. Net interest income projections should incorporate 
changing conditions for balance sheet positions, including embedded options, prepayment 
rates, loan performance, and re-pricing rates. 
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The following is a review of the Operational and Integrated Risk Management principles designed to address 
the learning ohjectives set forth hy GARP®. This topic is also covered in: 


Repurchase Agreements and 
Financing 


Topic 51 

Exam Focus 

Repurchase agreements, or repos, are short-term financing vehicles to borrow/lend funds on 
a secured basis. The most common repos are for overnight lending. This topic discusses the 
mechanics of repos, including settlement calculations, the motivations of market participants 
for entering into repos, as well as the risks (credit risk and liquidity risk) that arise from their 
use. It also discusses collateral types used in repos, including general collateral and special 
collateral. For the exam, focus on the characteristics of repo transactions and the primary 
motivations for using repos. Understanding these motivations should give you a good 
indication of how and why repos are used in the market, what risks repos hedge, what risks 
arise from repo trading, and how changes in the market environment affect repos. 


Mechanics of Repurchase Agreements 


LO 51.1: Describe the mechanics of repurchase agreements (repos) and calculate 
the settlement for a repo transaction. 


Economically, a repurchase agreement (i.e., repo) is a short-term loan secured by collateral. 
Mechanically, it is a contract between two parties where one party sells a security at a 
specified price with a commitment to buy back the security at a future date at another 
specified (higher) price. The difference between the sell and buy prices of the security is the 
implied interest (i.e., return) on the transaction. Repos are used by both borrowers needing 
short-term funds and by lenders needing short-term investments or access to hard-to-find 
collateral. 

The term repo refers to the transaction from the borrower\ side; that is, from the side that 
sold the security with a promise to buy it back. When we examine the same transaction 
from the lender's side, the transaction is referred to as a reverse repurchase agreement 
(i.e., reverse repo). Figures 1 and 2 illustrate an example of a repo trade. 

Figure 1: Repo Initiation 


$ 10 million face value ABC bond 


Counterparty A 


< 




Counterparty B 


$11,000,000 
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Suppose that on May 1, counterparty A wishes to borrow $11 million for 31 days. 

It therefore sells ABC bonds with a face value of $10 million and a market value of 
$11 million to counterparty B, with a contract price of $11 million to reflect the bonds 
market value. Concurrently, counterparty A agrees to buy back the bond in 31 days at the 
contract price plus 0.3% interest (30 basis points). 


Professor's Note: Interest rates for repos are always quoted at an annualized rate, 
and the convention for most money market securities is to use an actuall360 day 
count. 


The repurchase price in this example is computed as follows: 


$ 11,000,000 X 



0.3%x3r 
360 , 


$11,002,841.67 


As illustrated in Figure 2, on the June 1 termination of the repo trade, counterparty A will 
purchase back the $10 million face value ABC bond for $11,002,842. 


Figure 2: Repo Termination (Settlement) 


$ 10 million face value ABC bond 


Counterparty A 

< - 

-► 

Counterparty B 



$11,002,842 



LO 51.2: F!xplain common motivations for entering into repos, including their use 
in cash management and liquidity management. 


Borrowers in Repos 

From the perspective of the borrower., repos offer relatively cheap sources of obtaining short¬ 
term funds. Relative to unsecured borrowing, repos allow the borrower to obtain funds at 
favorable rates because lenders are willing to accept lower returns (relative to unsecured 
transactions) in favor of the security of collateral. 

Bond Financing 

Repos can also be used to obtain cash to finance a long security position. Consider a 
financial institution in the previous example (as counterparty A) that just purchased the 
same $10 million face value ABC bond from a client in hopes of selling it to another 
investor for a profit. Until the new buyer is found, however, the financial institution needs 
to finance the purchase of the bond. It can do so by borrowing cash through an overnight 
repo trade (from counterparty B) and pledging the ABC bond as collateral, subject to any 
applicable haircuts. If the financial institution cannot immediately find a buyer, it needs to 
roll/renew its position. If the initial repo trade and the subsequent rolls are transacted with 
the same counterparty, the trade flow is similar to Figure 1. 
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If the repo is renewed/rolled with a different counterparty, the financial institution first 
needs to unwind the initial trade (with counterparty B) and then enter into a new repo 
trade with another counterparty (counterparty C). This is illustrated in Figure 3. 

Similar to financing a bond purchase, the financial institution may also use repos to finance 
proprietary positions or to finance its inventory in order to make markets. 


Figure 3: Back-to-Back Repo Trades 

$ 10 million face $ 10 million face 

value ABC bond value ABC bond 


Counterparty C 




> 


Counterparty A 




> 


Counterparty B 


cash 


cash 


Liquidity Management 


Firms can borrow funds in different ways. They can issue equity capital or issue long-term 
or short-term debt, either on a secured or unsecured basis. Repos offer secured short-term 
financing; however, they are considered less stable given that repos need to be repaid within 
a short time period, and they are subject to swings in market conditions and sentiment. By 
contrast, equity financing is considered the most stable financing form given that the issuing 
firm has no obligation to pay dividends and equity financing does not need to be paid back. 
However, given its stability, equity financing is the most expensive and requires the highest 
expected return. By contrast, repo financing is cheaper but less stable. 

Firms need to balance this tradeoff between the costs of funding among the various 
alternatives and potentially being left without financing. This is referred to as liquidity 
management. 


Lenders in Repos 

From the perspective of the lender^ repos can be used for either investing or for financing 
purposes as part of an entity’s cash management or financing strategies. 

Cash Management (Repos as Investment Vehicles) 

Lenders use repos (taking the reverse repo side) for investing when they hold cash either for 
liquidity or safekeeping reasons and need short-term investing opportunities to generate 
return on their surplus cash position. For example, money market mutual funds hold 
cash for safekeeping on behalf of investors and therefore need low risk, short maturity 
investments to generate return rather than holding idle cash. Municipalities, on the 
other hand, have significant surplus cash generated from tax revenues. Municipalities are 
prohibited from investing in high-risk investments, and repos offer a low risk, collateral- 
secured investment opportunity. 

Investors look for liquidity and tend to favor very short-term positions in overnight 
repos, which provide significant flexibility to the investor. Following each overnight repo 
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transaction, the investor could re-evaluate its decision whether to continue lending cash. 

Investors may also transact in open repos by lending for a day under a contract that renews 
each day until it is canceled. Repos could have longer maturities out to several months, 
although typically the longer the maturity, the lower the overall demand. 

In addition to liquidity, investors also prefer higher quality collateral. Repo collateral is 
generally limited to high-quality securities, including securities issued or guaranteed by 
governments and government-sponsored entities. Because the lender is faced with the risk of 
a decline in collateral value during the term of the repo transaction, repo agreements often 
require collateral haircuts. A haircut refers to discounting the value of the collateral posted 
in relation to its risk. In our earlier repo trade example, counterparty B may only lend 
$10.5 million against the $11 million market value of the ABC bond collateral received. 

Finally, repo transactions are also subject to margining and (daily) margin calls. A margin 
call requires a borrower to post additional collateral in a declining market, but it also allows 
the borrower to withdraw excess collateral in up markets. 

Short Position Financing (Repos as Financing Vehicles) 

Lenders may also use repos (as the reverse repo side) to finance short positions in bonds. 

Consider an investment management firm that has a view that interest rates will rise and 
bond prices will fall. It can take advantage of this view by obtaining the desired bond 
collateral through lending cash in a reverse repo trade. It would then short sell the bond 
received through the reverse repo and buy it back at the market price at a later date, hoping 
to benefit from the trade from a fall in prices. The transaction flows would be similar to 
what we previously illustrated in Figure 1 and Figure 2, with the investment management 
firm as counterparty B. 

Counterparty Risk and Liquidity Risk 


LO 51.3: Explain how counterparty risk and liquidity risk can arise through the 
use of repo transactions. 


Repo transactions involve the exchange of cash as well as the exchange of collateral. As a 
result, both counterparty risk (credit risk) and liquidity risk are present. 

Counterparty risk is the risk of borrower default or non-payment of its obligations, and it 
arises because the lender is exposed to the risk of a failure by the borrower to repay the repo 
loan and interest. Given, however, that repo loans are secured by collateral, this makes the 
lender much less vulnerable to a decline in the creditworthiness of the borrower. The lender 
can recover any amounts owed by simply selling the collateral. As a result, because repos are 
generally very short-term transactions secured by collateral, counterparty (credit) risk is less 
of a concern. 

Liquidity risk is the risk of an adverse change in the value of the collateral and can be of 
particular concern to the lender. Even if the lender is less concerned with the credit risk 
of a counterparty given the security of collateral, the lender is still exposed to the risk 
of collateral illiquidity and to the value of the collateral declining during the repo term. 
Especially during times of market turbulence (as we will see in next LO), the value of 
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collateral can decline significantly and its liquidity can dry up. This risk can be mitigated 
with the use of haircuts, margin calls, reducing the term of the repo, and accepting only 
higher quality collateral. 


Repos During the Credit Crisis 


LO 51.4: Assess the role of repo transactions in the collapses of Lehman Brothers 
and Bear Stearns during the (2007-2009) credit crisis. 


Prior to the 2007-2009 credit crisis, the repo market was considered relatively liquid with 
stable demand by both borrowers and lenders. Borrowers often posted weaker quality 
collateral, including corporate bonds or mortgage-backed securities. This benefited both 
borrowers, who were able to post less desirable collateral, and lenders, who were able to 
obtain higher repo rates in exchange for accepting lower quality collateral. However, as 
the crisis escalated, lenders were reluctant to continue to accept these securities, and were 
increasingly demanding higher quality collateral and larger haircuts. At the extreme, they 
simply withdrew liquidity and stopped transacting in the markets. Borrowers that were the 
worst hit experienced collateral liquidations, capital declines, and ultimately bankruptcies. 
The case studies of Lehman Brothers and Bear Stearns provide important insights into the 
role of repo transactions in the demise of these once important institutions. 

Repos and Lehman Brothers 

JPMorgan Chase & Co. (JPM) was the tri-party repo clearing agent of Lehman Brothers 
Holdings, Inc. (Lehman). (In a tri-party repo agency arrangement, the repo trades are 
still executed between two counterparties; however, the collateral selection, payment, 
settlement, and repo management is outsourced to a third-party agent. Agents are essentially 
custodians and do not take on the risks of the transactions.) These tri-party repos were 
traded in the overnight market, and were transacted predominantly between institutional 
repo lenders and financial institution borrowers (including Lehman). Given that the trades 
were overnight transactions, they matured each morning, leaving the borrowers without 
funding during the rest of the day. To bridge this funding gap, JPM, as tri-party agent, was 
lending directly to Lehman on a secured basis during the day, typically without requiring 
haircuts on intraday advances. By August 2008, however, due to the increased risk in the 
repo markets, JPM began to phase in haircuts on intraday loans, with the loan amounts 
exceeding $100 billion in the final week of Lehmans bankruptcy. 


O 


Professor's Note: Lehman was one of the largest U.S. investment banks. 
The failure of Lehman in September 2008 was the largest in U.S. history 
($600 billion in assets). 


Both Lehman and JPM provide different viewpoints of the events leading up to Lehman s 
bankruptcy in September 2008. Despite the differing accounts, it is clear that the liquidity 
and value of collateral pledged in repo transactions declined during the crisis, and additional 
collateral and additional haircuts were necessary to mitigate the risks in repos. 
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According to Lehman, JPM, despite a conflict of interest due to its agent and lender role, 
breached its duty to Lehman and took advantage of its insider status (being insider to 
Lehmans internal financial condition and proposed business plans). Lehman accused JPM 
of using its influence to drain close to $14 billion in collateral from Lehman during the 
last few days before the bankruptcy, despite already being in an overcollateralized position. 

Although Lehman agreed at the time to provide additional collateral, it did so unwillingly 
and simply because there were no viable alternatives. 

According to JPM, however, JPM acted in good faith by providing continued funding to 
Lehman up until the last day, despite Lehmans deteriorating financial condition. When 
it became clear that the collateral posted to JPM by Lehman was illiquid with apparently 
overstated values, JPM s exposure to Lehman was growing at a time when Lehmans 
creditworthiness and financial condition was deteriorating. Nevertheless, JPM continued 
to lend money despite inadequate haircuts and collateral values. The close to $14 billion in 
additional collateral requested by JPM was significantly less than what was needed to cover 
JPM s true exposure. 

Repos and Bear Stearns 

Prior to 2007, Bear Stearns Companies, Inc., (Bear Stearns) relied on funding its 
borrowings primarily in the form of short-term unsecured commercial paper. By 2007, 
however. Bear Stearns switched from unsecured borrowing to a more stable form of 
borrowing through longer term, secured repo financing, which better positioned the firm 
to withstand market liquidity events. Given the high-quality collateral posted, the firm was 
able to obtain financing at favorable rates on a term basis. 

Given the events of 2007—2009, lenders during this period became increasingly less willing 
to provide loans in the form of repo trades, and were especially averse to providing term 
(rather than overnight) repos. This led to a general shortening of repo terms, requiring 
larger haircuts, and requesting borrowers to post higher quality collateral. In early 
March 2008, Bear Stearns experienced a run on the bank that resulted from a general 
loss of confidence in the firm. This bank run led to a massive withdrawal of cash and 
unencumbered assets (i.e., assets that have not been committed or posted as collateral), and 
lenders refused to roll over their repo trades. The rapid decline in market confidence and 
withdrawal of capital ultimately led to Bear Stearns’ collapse. 


Professor's Note: Bear Stearns was a U.S. investment bank and brokerage firm 
that was bailed out by the Federal Reserve Bank of New York and subsequently 
sold to JPM in March 2008. 


Collateral in Repo Transactions 


LO 51.5: Compare the use of general and special collateral in repo transactions. 


Repo trades can be secured either with general collateral or with specific (i.e., special) 
collateral. 
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General Collateral 

While lenders care about the quality of collateral delivered, under general collateral (GC), 
repo lenders are not concerned with receiving a particular security or class of securities as 
collateral. Instead, only the broad categories of acceptable securities are specified. The logic 
here is that when lenders are looking to receive a specific rather than generic security as 
collateral, this creates a demand for that security and lenders have to accept a lower return 
on the repo trade. GC trades suit investors in repos because they can obtain the highest repo 
rate for the collateral received. 

The repo rate for trades secured with general collateral is called the GC rate. GC rates can 
be used for repos with U.S. Treasury collateral, and the overnight rate for U.S. Treasury 
collateral is referred to as “the” GC rate. In the United States, the GC repo rate is typically 
slightly below the federal funds rate, although repos with U.S. Treasury collateral are 
considered safer and in fact can trade below the federal funds rate. The difference between 
the federal funds rate and the GC rate is measured through the fed funds-GC spread. 

This spread widens when Treasuries become scarcer (the GC rate falls) or during times of 
financial stress, as was the case during the recent financial crisis. 



Professor's Note: The federal funds rate is an interest rate that depository 
institutions in the United States charge each other for lending funds maintained 
at the Federal Reserve. 


Special Collateral 

When lenders are concerned with receiving a particular security as collateral, the collateral 
is referred to as special collateral, and the repo trade is called a specials trade. If you recall 
our discussion on financing as a motivation for repo lending, it should be clear that specials 
trades are particularly important in financing transactions used to obtain specific bonds. 

The repo rate for trades secured with special collateral is called the special rate. 

In specials trading, the lender of cash is concerned with receiving a particular security 
in order to finance the purchase of a bond (for shorting), or to finance its inventory or 
proprietary positions. Lenders accepting special collateral face a trade-off between receiving 
the desired security and lending at below GC rates to receive the desired security. Special 
rates differ by security because there is a rate for each security for each term. Special rates are 
determined by market supply and demand; however, it is important to note that the supply 
and demand of the underlying security is not the same as the supply and demand of the 
specials trade itself In fact, a bond that is in high demand in the market may not be in great 
demand as collateral for a specials trade. The reverse could equally be true. 
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Special Spreads and the Auction Cycle 


LO 51.6: Describe the characteristics of special spreads and explain the typical 
behavior of US Treasury special spreads over an auction cycle. 


The difference between the GC rate and the special rate for a particular security and term is 
called a special spread. Special spreads are important because in the United States, they are 
tied closely to the U.S. government Treasury bond auctions, and the level and volatility of 
the spread can be an important gauge of market sentiment. 

In the United States, federal government bonds are sold at auction based on a 
predetermined, fixed schedule. The most recent issue is called the on-the-run (OTR) or 
current issue, while all other issues are called ofF-the-run (OFR). Current OTR issues tend 
to be the most liquid, with low bid-ask spreads, that can be liquidated quickly even in large 
sizes. This liquidity makes them desirable for both long positions and short positions. For 
example, a repo lender would favor these securities for short positions because the shorts 
could be covered quickly and at a relatively low cost. The popularity of OTR issues as 
special collateral in repo trades historically resulted in lower repo rates and wider special 
spreads. 

Several observations can be made by looking at the special spreads of OTR Treasury 
securities (OTR special spreads) and the auction-driven pattern of special spreads. First, 
OTR special spreads can be volatile each day depending on the special collateral. Second, 
spreads can fluctuate over time. Third, and most important, OTR special spreads are 
generally narrower (smaller) immediately after an auction but wider before auctions. They 
are narrower after auctions due to the extra supply of a new OTR security, which depresses 
special spreads. Spreads widen before auctions due to the substitutability of the special 
collateral as shorts change to the new OTR security. 

The influence of auctions can also be observed from the term structure of individual OTR 
issues based on term special spreads (the difference between term GC rates and term special 
rates). Term special spreads are expected to decline immediately following the issue of the 
new OTR security but increase closer to the dates of the new auctions. 


Special Spreads and Rate Levels 

Special spreads generally move within a band that is capped at the GC rate (implying a floor 
of 0% for the special rate). When a trader short sells the OTR Treasury security but fails to 
deliver on settlement, the trader would not receive cash from the sale and would also miss 
out on a days interest on the cash. To satisfy the settlement obligation to deliver the bond, 
the trader could borrow the bond in the overnight repo market and pay a special rate of 0% 
(essentially the trader provides free financing in exchange for receiving the desired bond). At 
any rate below 0%, no trader would borrower the bond. This puts both an effective lower 
bound and an effective cap of the special spread at the GC rate. 

The special spread can also be tied to the penalty for failed trades. Until 2009, there was 
no penalty for failed trades. However, in light of the financial crisis and trillions of dollars 
in failed OTR deliveries, regulators adopted a penalty rate for failed trades, equal to the 
greater of 3% minus the federal funds rate, or zero. This means that as the federal funds rate 
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increases, the penalty falls, and when the federal funds rate declines to zero, the penalty rate 
reaches its maximum at 3%. As a result, the new upper limit for the special spread is the 
penalty rate. 


LO 51.7: Calculate the financing advantage of a bond trading special when used in 
a repo transaction. 


The premium trading value of OTR bonds is due both to their liquidity and financing 
advantage as we previously discussed. The liquidity advantage stems from the ability to sell 
these bonds quickly for cash. The financing value stems from the ability to lend the bonds 
at a cheap special rate and use the cash to lend out at higher GC rates. This financing value 
is dependent on the trader s expectation of how long the bond will continue trading at its 
special rate before the rate moves higher toward the GC rate. 


Let s assume that an OTR bond is issued on January 1 and trades at a special spread of 
0.18%. A trader expects the bond to trade at GC rates past March 31. The financing value 
of the OTR bond is therefore the value over 90 days. The value of $100 of cash at the 
spread of 0.18% is: 


$100 


90x0.18% 

X- 

360 


$0,045 


Thus, the financing value is 4.5 cents per $100 market value of the bond. 
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Key Concepts 


L0 51.1 

Repurchase agreements, or repos, are bilateral contracts where one party sells a security at 
a specified price with a commitment to buy back the security at a future date at a higher 
price. From the perspective of the borrower we refer to repos, while from the perspective of 
the lender we refer to reverse repos. Repos are valued based on a simple time value of money 
calculation. 


LO 51.2 

From the perspective of the borrower, repos offer relatively cheap sources of obtaining short¬ 
term funds. Balancing the cost of funding (e.g., through repos) and other sources of funds 
(including potentially no funding) is called liquidity management. 

From the perspective of the lender, repos can be used for either investing (cash 
management) or for financing purposes (e.g., to finance short bond positions). 


LO 51.3 

Repos give rise to both counterparty risk and liquidity risk. Counterparty (credit) risk is the 
risk of borrower default or non-payment of its obligations. Liquidity risk is the risk of an 
adverse change in the value of the collateral. Counterparty risk is mitigated with collateral, 
while liquidity risk is mitigated with haircuts, margin calls, shorter repo terms, and higher 
quality collateral. 


LO 51.4 

During the recent financial crisis, lenders were increasingly demanding higher quality 
collateral and larger haircuts and even withdrew liquidity altogether. Borrowers experienced 
collateral liquidations and capital declines, leading to several high profile company failures 
and bankruptcies. The failures of Bear Stearns and Lehman Brothers illustrate these events. 


L0 51.5 

Repo trades can be secured either with general collateral or with specific collateral. Lenders 
(as investors) in general collateral (GC) repo trades are not concerned with receiving a 
specific security, and only the broad categories of acceptable securities are specified. GC 
trades suit investors in repos because they can obtain the highest repo rate for the collateral 
received. Lenders (as financing participants) in special collateral repo trades (specials trades) 
are concerned with receiving a particular security as collateral. The particular security 
received can then be used to finance the purchase of a bond (for shorting) or to finance its 
inventory or proprietary positions. 
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L0 51.6 

The difference between the GC rate and the special rate for a particular security and term 
is called a special spread. Special spreads are tied closely to Treasury bond auctions, and the 
level and volatility of the spread can be an important gauge of market sentiment. Special 
spreads are generally narrower immediately after an auction, but widen before auctions. 
Spreads generally move within a band that is capped at the GC rate (implying a floor of 0% 
for the special rate). 

Following the recent financial crisis, regulators adopted a penalty rate for failed trades at the 
greater of 3% minus the federal funds rate, or zero. As a result, the penalty rate becomes the 
new upper limit for the special spread. 


L0 51.7 

The financing value of the bond is the ability to lend the bonds at a relatively cheap special 
rate and use the cash to lend out at higher GC rates. This financing value is dependent on 
the traders expectation of how long the bond will continue trading at its special rate. 
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Concept Checkers 


1. Pasquini Investments (Pasquini) is a private brokerage looking for 30-day financing 
of $25 million of its accounts payable but is unsure whether the appropriate 
investment is a term repurchase agreement (repo) or a term reverse repo agreement. 
Pasquini is willing to post AAA-rated government bonds as collateral. The bonds 
have a face value of $27 million and a market value of $25 million. The firm is 
quoted a rate of 0.5% for the transaction. Which of the following choices most 
accurately reflects the contract type and the contract price needed by Pasquini? 



Contract tvpe 

Contract price 

A. 

Repo 

$27,011,250 

B. 

Reverse repo 

$25,010,417 

C. 

Repo 

$25,010,417 

D. 

Reverse repo 

$27,011,250 


2. Posting collateral and requiring collateral haircuts are important risk mitigants in 
repo transactions with respect to which of the following risks? 


Posting collateral 

A. Market risk 

B. Credit risk 

C. Market risk 

D. Credit risk 


Collateral haircuts 

Interest rate risk 
Interest rate risk 
Liquidity risk 
Liquidity risk 


3. Kotra Bank Holdings, Inc., (Kotra) is currently weighing the cost of its funding 
against the risk of being left without financing. The term that best describes Kotras 
activities is: 

A. counterparty (credit) risk. 

B. specials trading. 

C. liquidity management. 

D. overnight funding. 

4. In a presentation to management, a bond trader makes the following statements 
about repo collateral: 

Statement 1: ''The difference between the federal funds rate and the general collateral 
rate is the special spread ." 

Statement 2: "During times of financial crises, the spread between the federal funds rate 
and the general collateral rate widens ." 

Which of the traders statements are accurate? 

A. Both statements are incorrect. 

B. Only Statement 1 is correct. 

C. Only Statement 2 is correct. 

D. Both statements are correct. 
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5. The latest on-the-run (OTR) Treasury bond issued on March 1 is trading at a special 
spread of 0.25%. Traders expect the bond to trade at general collateral (GC) rates 
past June 30. The financing value of the OTR bond is therefore the value over 122 
days. Given this information, the value of lending $100 of cash is closest to: 

A. $0,085. 

B. $0,250. 

C. $0,305. 

D. $0,847. 
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Concept Checker Answers 


1. C Given that Pasquini is a borrower in the repo market, the transaction is a repo from the 

perspective of the firm (but a reverse repo from the perspective of the lender). The contract 
price is calculated as follows: 


$25,000,000 X 


1 + 


0.5% X 30 
360 , 


$25,010,417 


2. D Collateral is an important counterparty credit risk mitigant. Repo loans are secured by 

collateral, which makes the lender much less vulnerable to a decline in the creditworthiness 
of the borrower. Collateral haircuts are important in mitigating liquidity risk in repo 
transactions. The lender is exposed to the risk of the value of the collateral declining during 
the repo term, which can be mitigated by requiring (higher) haircut values, that is, discounts 
to the value of the posted collateral. 

3. C The process of weighing the cost of its funding against the risk of being left without 

financing is called liquidity management. Counterparty (credit) risk is the risk of borrower 
default or non-payment of its obligations. In specials trading, a lender of cash initiates a repo 
trade in order to receive a particular security (special collateral). Overnight funding refers to 
borrowing and lending in the overnight market. 

4. C The trader’s first statement is incorrect. The difference between the federal funds rate and 

the general collateral (GC) rate is known as the fed funds-GC spread. The special spread is the 
difference between the GC rate and the special rate for a particular security. 

The trader s second comment is correct. During times of financial crises, the spread between 
the federal funds rate and the general collateral rate widens as the willingness to lend Treasury 
securities declines, lowering the GC rate (thereby increasing the spread). 

5. A The financing value of $100 of cash at a spread of 0.25% is calculated as: 

^100x122x02^ ^ $0.0847 or 8.47 cents 
360 
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Topic 52 

Exam Focus 

This topic addresses the calculation of liquidity cost and applies this value to the value at risk 
measure. We will see how to compute liquidity-adjusted VaR (LVaR) when considering both 
a constant spread and an exogenous spread approach. Be familiar with how to make these 
calculations, particularly for the constant spread approach. Also, understand the concept of 
cash flow at risk (CFAR) and how liquidity is impacted during a crisis. 


Liquidity Risk 


LO 52.1: Define liquidity risk and describe factors that influence liquidity, 
including the bid-ask spread. 


Liquidity risk is the degree to which a trader cannot trade a position without excess cost, 
risk, or inconvenience. When liquidity risk exists, there can be several types of price 
uncertainty. First, the usual market quote of the average of the bid and ask prices becomes 
less meaningful because the spread is wider, which means the market quote is even farther 
from either the buy or sell transaction price. Second, a larger bid-ask spread means a higher 
cost to get in and out of the position. Third, the actual price of either a buy or sell order 
is less certain because the assets do not trade frequently, and the quoted bid and ask prices 
will probably not be the prices of the respective sell and buy transactions when actually 
executed. There is also an increased risk in that the spread can change (i.e., it is stochastic), 
which will increase the risks of trading. 

Liquidity is a function of the type of market and its characteristics. It depends on factors 
such as the number of traders in the market, the frequency and size of trades, the time it 
takes to carry out a trade, the cost, and the risk of the transaction not being completed. 

It also depends on the type of asset and the degree to which the asset is standardized. A 
less standardized asset will have higher liquidity risk. A forward contract has much more 
liquidity risk than a futures contract, for example, because the forward contract is not 
a standardized contract. Over-the-counter (OTC) derivatives of all types usually have 
relatively high liquidity risk. 

Bid-Ask Spread 

The bid-ask spread is a cost of liquidity. A wider (narrower) spread indicates lower (higher) 
liquidity. If an asset becomes less liquid, the spread increases, and the costs of trading the 
asset increase. The risk of liquidity changing, and changes in the spread, should be included 
with other measures of market risk. The spread can also change as a result of the activities of 
a given trader when liquidity is endogenous, which is described in the next LO. 
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LO 52.2: Differentiate between exogenous and endogenous liquidity. 


Exogenous liquidity refers to the bid-ask spread not being affected by the individual trades 
made by investors. This is more likely to be the case when the trades are relatively small. 
Endogenous liquidity refers to when a given trade can influence the liquidity risk of the 
trade (i.e., a trader submitting a buy or sell order that increases the spread). If an investor 
attempts to purchase a large block of an asset, for example, the buy order may have an 
impact on the spread and increase the cost over that indicated by the initial bid-ask prices. 
This can also happen when an investor tries to liquidate an asset. This type of endogeneity 
problem is more likely in illiquid markets and when the trade is large relative to the market. 

In summary, for endogenous markets, if a trader attempts to liquidate (buy) a large 
position, the trader should expect the bid (ask) price to fall (increase) and the bid-ask spread 
to widen. The trader should include such a market reaction when estimating liquidity costs 
and risks. In both the endogenous and exogenous case, the bid-ask spread is still a function 
of the factors already mentioned (the number of traders, the standardization of the asset, 
low transactions costs, etc). 


Liquidity-Adjusted V^R 


LO 52.3: Describe the challenges of estimating liquidity-adjusted VaR (LVaR). 


One of the challenges of estimating liquidity-adjusted value at risk (LVaR) is choosing the 
best method. As in most choices, there is a tradeoff between sophistication and ease of 
implementation, and it is worth noting that sophistication and usefulness are not necessarily 
positively correlated. It is recommended to find approaches that are transparent in their 
assumptions and simple to implement (e.g., implementable with just a spreadsheet). A good 
way to do this is to determine liquidity “add-ons” that allow a researcher to modify original 
VaR estimates that did not include factors for illiquidity. In addition to addressing liquidity, 
the approach can also assess the impact of assumptions on estimates of VaR. 

Another challenge is liquidity adjustments that are compatible with the basic VaR approach 
and each other. This is because different methods look at different aspects of illiquidity, 
and it can be helpful to combine ‘add-ons’ that give the best overall liquidity adjustment. 

In other words, two less sophisticated methods may be much better than one really good 
sophisticated method. 

Another challenge is to check how the liquidity adjustment changes other inputs, such as 
the confidence level, holding period, or any other parameters (i.e., the sensitivity of the 
other inputs to the liquidity adjustment). The researcher should be aware of some basic 
relationships (e.g., an increase in the holding period should lower the level of the liquidity 
adjustment). 

The researcher should try to calibrate the model against real data (e.g., check if the bid-ask 
spread parameters are empirically plausible), and properly stress test the model, as well as 
backtest the model. The researcher should be aware that there is probably not a single, best 
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approach that would exclude the use of all others. Furthermore, using different approaches 
can help highlight different liquidity concerns. 


LO 52.4: Describe and calculate LVaR using the constant spread approach and the 
exogenous spread approach. 


The constant spread approach, as the name implies, calculates LVaR assuming the bid-ask 
spread is constant. This makes the liquidity cost equal to half the spread multiplied by the 
size of the position to be liquidated. The liquidity cost (LC) to add on to the initial VaR 
estimate is then: 


LC = 0.5 X V X spread 
where: 

V = value of the position 

(ask price — bid price) 
(ask price + bid price) / 2 



Recall that VaR quantifies the maximum loss for a given confidence level over a particular 
holding period. For example, a typical VaR calculation may indicate a 1% probability of 
losses exceeding $10 million over a five-day holding period. LVaR is calculated using the 
following formula assuming a constant spread: 


LVaR = (V X X O') + [0.5 x V x spread] 


LVaR = VaR+LC 
where: 

V = asset (or portfolio) value 
z^ = confidence parameter 
a = standard deviation of returns 


Professor's Note: Notice that VaR in this example is dollar VaR as opposed to 
percentage VaR. 


The confidence level of the estimate is 1 — a (e.g., 5% level of significance (a) = 95% 
confidence level). Note that the larger the spread, the larger the calculated LVaR. Since 
liquidity risk incorporates selling the asset, not a full “round trip,” only half of the spread 
is used. 
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Example: Computing LVaR 

Suppose that ABC Company has a current stock price of $100 and a daily standard 
deviation of 2%. The current bid-ask spread is 1%. Calculate LVaR at the 95% 
confidence level. Assume a constant spread. 

Answer: 

LVaR = (100 X 1.65 x 0.02) + (0.5 x 100 x 0.01) = $3.80 


The previous discussion involved the use of normal VaR (i.e., VaR assuming asset prices are 
normally distributed). In practice, asset prices are lognormally distributed as was illustrated 
in the FRM Part I curriculum when we examined the Black-Scholes-Merton option pricing 
model. In this assigned reading, the author uses lognormal VaR to calculate the liquidity- 
adjusted VaR. The conventional lognormal VaR, with no adjustment for liquidity risk, is 
calculated in the following fashion: 


Lognormal VaR = [1 — exp(p — cr x z^] x V 
where: 

p = mean return 

The liquidity-adjusted VaR is then calculated as follows: 


LVaR = VaR + LC = [1 - exp(p - a x + 0.5 x spread] x V 


Using the simplifying assumption of p = 0, the ratio of LVaR to VaR becomes: 

LVaR ^ spread 

-= 1H- 

VaR 2 X [1 — exp(—a x z^^)] 

This expression indicates that the liquidity adjustment will increase (decrease) when there 
is an increase (decrease) in the spread, a decrease (increase) in the confidence level, and a 
decrease (increase) in the holding period. 


Professor's Note: Notice that the calculation of lognormal VaR and normal 
VaR will be similar when we are dealing with short-time periods and practical 
return estimates. 


Example: Computing LVaR to VaR ratio (constant spread) 

Assume the following parameters: p = 0, a = 0.012, spread = 0.02, and a 95% confidence 
level. Compute the LVaR to VaR ratio. 
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Answer: 

LVaR , 0.02 

- = 1 +-^-. = 1.51 

VaR 2x[l-exp(-0.012xl.65)] 

The increase from VaR to LVaR is just over 50%, from only a 2% spread. This 
demonstrates that even a small spread can translate into a surprisingly large liquidity 
adjustment to VaR. 


LVaR can also be calculated given the distribution characteristics of the spread. This is the 
foundation underlying the exogenous spread approach. If you are given the mean and 
standard deviation of the spread, you would apply the following formula: 

LVaR = VaR + 0.5 x x a^)] x V 


Professor's Note: We add the confidence parameter times the volatility of the 
spread to the mean of the spread since the liquidity adjustment increases the 
value at risk. Also, notice that the confidence parameter (or z-score) used for 
the uncertainty of the spread is labeled differently. The confidence parameter, 
in this case, is a value to be determined. 


The exogenous spread approach assumes that the spread is stochastic and that the trades of 
a single trader do not affect the spread. The spread could follow one of many distributions; 
for example, the normal distribution or a more leptokurtic distribution (historically, the 
distribution of the spread has been highly non-normal with excess amounts of kurtosis). 
Once having assumed a distribution, the researcher can estimate the LVaR using Monte 
Carlo simulation by simulating values for both V and the spread, incorporating the spread 
into V to get liquidity-adjusted prices, and then infer the liquidity-adjusted VaR from the 
distribution of simulated liquidity-adjusted prices. 


Example: Computing LVaR (assuming normal VaR) 

Suppose that ABC Company has a current stock price of $100 and a daily standard 
deviation of 2%. The mean of the bid-ask spread is 2%, and the standard deviation of 
the bid-ask spread is 1%. Calculate LVaR at the 95% confidence level assuming the 
confidence parameter of the spread is equal to 3. 

Answer: 

LVaR = (100 X 1.65 X 0.02) + LoO X (0.02 + 3 X 0.01) = $5.8 
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The researcher can determine the optimal value of t!^ using some suitably calibrated Monte 
Carlo exercise [Bangia et al. (1999)^ assume a value of three for Applying lognormal 
assumptions, the LVaR using the exogenous spread approach is the lognormal VaR plus the 
liquidity adjustment: 


LVaR = VaR + LC = V x {[1 - exp(p -ox z^)] + [0.5 x (p^ + z'^ x o^)]} 

It is worth noting that if equals zero, then this expression becomes the LVaR formula for 
the constant spread approach where = spread. Thus, this approach is simply the constant 
spread approach with an added expression to allow for a stochastic spread. 

We can now apply the familiar LVaR to VaR ratio: 

LVaR ^ j I ^ (fig+z^xag) 

VaR VaR 2 x [l — exp(—o x )] 


Example: Computing LVaR to VaR ratio (exogenous spread) 

A researcher estimates the mean and standard deviation of the spread to be 0.02 and 
0.005, respectively. He also estimates that p = 0 and a = 0.012 for the underlying returns 
distribution. Using a 95% confidence level, compute the ratio of LVaR to VaR. Assume 
the confidence parameter for the spread, z'^, is equal to 3. 

Answer: 

LVaR ,, (0.02 + 3x0.005) 

-— 1 “I- ; -7 — 1.0!;/ 

VaR 2 X [1 - exp(-0.012 x 1.65)] 

The result here, when compared to the previous answer, demonstrates how including the 
possibility of the spread being random (stochastic) can increase the liquidity adjustment. 
In this case, it almost doubles from 51% to 89%. 


Endogenous Price Approaches 


LO 52.5: Describe endogenous price approaches to LVaR, their motivation and 
limitations, and calculate the elasticity-based liquidity adjustment to VaR. 


Both the constant spread approach and the exogenous spread approach assume that prices 
do not change in response to trading (i.e., prices are exogenous). This may not always be the 
case, and it may be necessary to make a liquidity adjustment for endogenous prices. In the 
case of selling for example, there may be downward pressure on prices, which causes a loss. 
VaR should include an adjustment for the possibility of this loss. The adjustment should be 
larger if the market prices are more responsive to trades. 

1. Bangia, A.F. Diebold, T. Schuermann, and J. Stroughair. (1999). “Liquidity on the outside.” 

Risk 12 (June): 68-73. 
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Of the various ways to include an adjustment, a relatively simple method uses the concept 
of elasticity, E. In this case, it is the proportional change in price divided by the proportion 
of the market traded: 

AP/P 

AN/N 

where: 

AN/N = size of the trade relative to the entire market 

Generally, it is the case that E < 0 and AN/N > 0. A researcher can estimate values for E 
and AN/N and input them into an expression for LVaR as follows: 


LVaR = VaRx 


p- 

< 

= VaRx 

anI 

1- 

1 Ex 

p, 


N , 


LVaR 

VaR 


= 1-Ex 


AN 

N 


The approach is very convenient because the adjustment is independent of the computation 
of VaR and its assumptions, and the ratio of LVaR to VaR is a function of only two inputs. 
The obvious limitation is its narrow focus and that it entirely ignores bid-ask spreads and 
transactions costs. On the other hand, a researcher can easily combine this adjustment with 
one of the other liquidity adjustments by simply multiplying the effects: 


LVaR 


VaR 


LVaR 


combined 


VaR 


X- 


LVaR 


exogenous 


VaR 


mdoge 


Example: Endogenous price approach 


A trader has a position worth 10% of the size of the market (i.e., AN/N = 0.1) and 
estimates that E = -0.4 so that AP/P = E x AN/N = -0.4 x 0.1 = -0.04. Compute the 
ratio of LVaR to VaR based only on endogenous factors and the combined LVaR to VaR 
ratio assuming the ratio for the exogenous approach is 1.89. 


Answer: 


LVaR 


VaR 


endogenous 


= l-(-0.04) = 1.04 


Thus, the adjustment for endogeneity will increase the total adjustment for liquidity 
by 4%. Using the liquidity adjustment for the exogenous approach yields the following 
combined result: 


LVaR 


VaR 


combined 


= 1.89x1.04 = 1.97 
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Jarrow and Subramanian (1997)^ offer a more sophisticated method called the liquidity 
discount VaR, where the trader maximizes expected utility by liquidating the position 
within a certain period of time. It incorporates both exogenous and endogenous market 
liquidity, spread cost, spread risk, an endogenous holding period, and an optimal 
liquidation policy. It does so with three modifications: (1) uses an optimal holding period 
based on the traders expected-utility optimization problem, (2) adds the average liquidity 
discount to the traders losses, and (3) has the volatility measure include the volatility of the 
time to liquidation and the volatility of the liquidity discount factor, as well as the volatility 
of the underlying market price. 

Liquidation, Transactions Costs, and Market Price Impact 

As with most ancial activities, there are tradeoffs to consider when executing a trade. 

Attempting to sell quickly will usually increase the transactions costs and may have an 
unfavorable impact on the selling price. Taking more time to sell can increase the exposure 
to exogenous and unfavorable price changes. A trader should recognize the tradeoff and 
identify a set of efficient trading strategies that produce the minimum remaining risk 
exposure at any given point in time, for any given expected cost. The trader should choose 
the strategy that best fits his risk aversion. A more (less) risk averse trader would choose 
a strategy that executes more (less) quickly. A more (less) quick execution will reduce 
(increase) price uncertainty with higher (lower) transactions costs. 

Liquidity at Risk 


LO 52.6: Describe liquidity at risk (LaR) and compare it to LVaR and VaR, 
describe the factors that affect future cash flows, and explain challenges in 
estimating and modeling LaR. 


Liquidity at risk (LaR) is also known as cash flow at risk (CFaR) and is the maximum likely 
cash outflow over the horizon period at a specified confidence level. A positive (negative) 
value for LaR means the worst outcome will be associated with an outflow (inflow) of cash. 
LaR is similar in concept to VaR, but instead of a change in value, it deals with a cash flow. 
LaR is also distinct from liquidity-related losses, but they are related. 

As an example, an investor has a large market risk position that is hedged with a futures 
position. If the hedge is a good one, the basis risk is small, and the VaR should be small. 
There is the possibility of margin calls on the futures position, however, and this means 
there is the possibility of a cash outflow equal to the size of that position. In summary, the 
hedged position has a small VaR but a large LaR. At the other extreme, European options 
have zero LaR until expiration, but potentially large VaR prior to maturity. 

The following is a list of factors that influence cash flows and LaR: 

• Borrowing or lending. 

• Margin requirements on market risk positions that are subject to daily marking to market. 

• Collateral obligations, such as those on swaps, which can generate inflows or outflows of 
cash from changes in market factors, such as interest rates. 


2. Jarrow, R.A. and A. Subramanian. (1997). “Mopping up liquidity.” Risk 10 (December): 
170-173. 
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• Short explicit options or implicit options (e.g., convertibility and call features). 

• Changes in risk management policy (e.g., a change in the type of hedge), which may 
change mark-to-market requirements. 

Two other considerations are as follows: (1) LaR can increase when the firm is facing hard 
times (e.g., a credit downgrade increases the rate on bank loans); and (2) there are positions 
that are similar in terms of market risk (e.g., a futures versus an options hedge), but are very 
different in terms of LaR. 

As a practical matter for the firm attempting to estimate LaR, consider using the firms 
VaR procedures to estimate the VaRs of marginable securities and then combine this LaR 
estimate with comparable figures from other sources of liquidity risk within the organization 
to produce an integrated measure of firm-wide liquidity risk. The point is to use the existing 
and accepted VaR procedures to estimate liquidity risks. It is obviously ad hoc, however, and 
a firm facing complex liquidity risks should build a more appropriate model. This would 
involve identifying and modeling the variables indicated in the following list: 

• The certain cash flows (e.g., from U.S. Treasury investments). 

• The unconditional uncertain cash flows (e.g., from risky bonds). 

• The conditional uncertain cash flows (e.g., those that only result if a certain decision is 
made, such as making an investment). 

• Other conditioning variables that might trigger cash flows. 

Having identified the factors, the manager can construct an appropriate engine to estimate 
the risks. Estimating the LaR may only require a variance-covariance approach, or it may 
require a more advanced simulation approach. 


Role of Liquidity During Crisis 


LO 52.7: Describe approaches to estimate liquidity risk during crisis situations and 
challenges which can arise during this process. 


In a crisis, assumptions concerning the level of liquidity and other properties that are 
reasonable in a “normal” market may not hold. Such crises have occurred in 1987, 1992, 
1998, and 2007—2009. Some event usually precipitates the crisis, such as a large fall in some 
asset prices, which leads to lower demand and wider bid-ask spreads. The time needed for 
selling orders to be executed increases. Market liquidity falls at the very time the market 
needs it. 

Many things change during the course of a crisis, and a researcher needs a model that takes 
into account the distinctive features of a crisis (e.g., large losses, high bid-ask spreads). 
CrashMetrics may be one way to address this. As an example, the following is the profit/loss 
on a derivative position based on a delta-gamma approximation: 

ri = 8AS +^(AS)2 
2 

where: 

AS = change in the stock price 
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Taking the derivative of this measure with respect to AS and solving for AS gives the 
change that produces the maximum loss: AS = -b/% and that maximum loss in absolute 
value terms is: 


max(loss) = — min(n) = — 


For a derivative position that requires margin and mark-to-market, letting m equal the 
margin requirement, the worst-case cash outflow is simply m times this amount: 
m X 8^/(2^). This approximation can be more precise with the inclusion of the effects of 
other Greeks (e.g., thetas), counterparty risk, and other factors. 

Another method for examining the liquidity consequences associated with worst-case 
scenarios is to apply the basic procedure above to an extreme-value method estimated with 
expected shortfall (ES). The cash flow would then be m x ES. 

These two variations of estimating the worst-case cash flow do not address many real-world 
complications. A researcher might also wish to address the complications with simulations 
designed for specific complications. Those complications include: 

• The discreteness of credit events. 

• The interdependency of credit events. 

• The interaction of credit and market risk factors. 

• Complications arising from the use of credit-enhancement methods, such as netting 
arrangements, periodic settlement, credit derivatives, credit guarantees, and credit triggers. 

Crisis-scenario analysis is an alternative to the probabilistic approaches described 
previously. This would involve analyzing the potential problems of a particular event (e.g., 
the failure of a major institution) and working through the specific details of how this might 
occur. This has the advantage of working through scenarios at a chosen level of detail and 
accounting for complications and interactions. The problem is that there will be a lot of 
subjectivity, and the results will depend heavily on the assumptions used. 
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Key Concepts 


L0 52.1 

Liquidity risk is the degree to which a trader cannot trade a position without excess cost, 
risk, or inconvenience. Liquidity depends on factors such as the number of traders in the 
market, the frequency and size of trades, the time it takes to carry out a trade, the cost, and 
the risk of the transaction not being completed. It also depends on the type of asset and the 
degree to which the asset is standardized. 

A wider (narrower) bid-ask spread indicates lower (higher) liquidity. If an asset becomes less 
liquid, the spread increases, and the costs of trading the asset increase. 


LO 52.2 

Exogenous liquidity refers to the bid-ask spread not being affected by the individual trades 
made by investors. This is more likely to be the case when the trades are relatively small. 

Endogenous liquidity refers to when a given trade can influence the liquidity risk of the 
trade (i.e., a trader submitting a buy or sell order that increases the spread). 


LO 52.3 

The main challenge in estimating liquidity is finding the best method. One approach is 
finding adjustments to add on to the basic VaR. The researcher must understand how the 
inputs affect the “add-ons” and, if there are more than one, how the add-ons interact. 


LO 52.4 

The constant spread approach assumes the bid-ask spread is constant and the liquidity cost 
is simply, LC = 0.5 x spread x V, which can be added into the VaR formula. 


VaR = [1 - exp(p -ox z^)] x V 


LVaR = VaR + LC = [1 - exp(p - o x z^) + 0.5 x spread] x V 


LO 52.5 

To account for endogeneity, a trader may estimate the elasticity of the price to the 
proportion of the market in a given large trade, denoted E, the proportion itself, denoted 
AN/N, and adjust the VaR formula. 


LVaR = VaR X 


■ API 

= VaRx 


1- 

1-Ex 

P . 


N . 
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Liquidity at risk (LaR) is also known as cash flow at risk (CFaR) and is the maximum likely 
cash outflow over the horizon period at a specified confidence level. 

LaR can be very different from the VaR of the same position. For example, a bond hedged 
with a futures contract has low VaR but high LaR from the possible margin call on the 
futures contract. 

Factors that affect future cash flows are: borrowing or lending, margin requirements, 
collateral obligations, options positions, and changes in risk management policy. 


LO 52.7 

Many things change during the course of a crisis, and a researcher needs a model that takes 
into account the distinctive features of a crisis (e.g., large losses, high bid-ask spreads). 
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Concept Checkers 


1. Suppose that portfolio XYZ has a $1,000,000 portfolio invested in a stock that has 
a daily standard deviation of 2%. The current bid-ask spread of that stock is 1%. 
Assuming a constant spread, what is the liquidity-adjusted VaR (normal VaR) at the 
95% confidence level? 

A. $5,000. 

B. $38,000. 

C. $44,200. 

D. $43,000. 

2. Which of the following actions would most likely increase liquidity risk? 

A. A rapid execution of orders. 

B. A higher level of standardization of the asset. 

C. An increase in the number of traders and a decrease in the size of those trades. 

D. A decrease in the number of traders and an increase in the size of those trades. 

3. When a given trade can influence the liquidity risk of a trade, this type of liquidity is 
known as: 

A. exogenous liquidity. 

B. undefined liquidity. 

C. endogenous liquidity. 

D. operational liquidity. 

4. Assuming the following parameters: p= 0, cr = 0.006, spread = 0.01, and a 95% 
confidence level, the ratio of LVaR to VaR is closest to: 

A. 1.08. 

B. 1.51. 

C. 1.66. 

D. 2.04. 


5. A trader has a position worth 5% of the size of the market (i.e., AN/N = 0.05) and 
estimates that the elasticity of price to size of trade is: E = —0.2. The ratio of LVaR to 
VaR based only on endogenous factors is closest to: 


A. 

0.99. 

B. 

1.01. 

C. 

1.05. 

D. 

1.40. 
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Concept Checker Answers 


1. B LVaR = (1,000,000 x 1.65 x 0.02) + (0.5 x 1,000,000 x 0.01) = $38,000 

2. D Larger and fewer traders will ultimately lower liquidity and increase liquidity risk. 

3. C It is “endogenous” because it is determined by the trading activity itself. 


4. B 


LVaR 


= 1 + - 


0.01 


VaR 2 X [1 - exp(-0.006 x 1.65)] 
5. B AP/P = ExAN/N =-0.2x0.05 =-0.01 


= 1.508 


LVaR 


VaR 


= l-(-0.01) = 1.01 


endogenous 
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The following is a review of the Operational and Integrated Risk Management principles designed to address 
the learning ohjectives set forth hy GARP®. This topic is also covered in: 


Assessing the Quality of 
Risk Measures 


Topic 53 

Exam Focus 

This topic focuses primarily on model risk and model errors, with specific criticisms of the 
value at risk (VaR) model. It is important to understand model risk and the factors that 
could result in variability in VaR estimates. It is also important to understand the challenges 
associated with mapping risk factors to positions in making VaR calculations. Be ready to 
explain how incorrect mapping factors can understate certain risks including reputational, 
liquidity, market, and basis risk. The second part of this topic focuses on two specific case 
studies on the failures in strategies during 2005 and 2007-2009 related to modeling errors 
and the underestimation of key risks. 


Model Risk 


LO 53.1: Describe ways that errors can be introduced into models. 


Models are highly useful in simulating real-life scenarios; however, they can suffer from 
several risks. Model risk is the risk of incorrect trading or risk management decisions due 
to errors in models and model applications, which can lead to trading losses and give rise 
to legal, reputational, accounting, and regulatory risk. Biases in models themselves do 
not necessarily cause model risk; however, inaccurate or inappropriate inputs can create 
distortions in the model. 

There are several ways in which errors can be introduced into models. These include bugs in 
the programming of model algorithms, securities valuations or hedging, variability of value 
at risk (VaR) estimates, or inaccurate mapping of positions to risk factors. 

For example, bugs in programming occurred in May 2008 when Moody s used flawed 
programming to incorrectly assign AAA ratings to certain structured credit products. It 
happened again in October 2011 when bugs in the quant programming used by AXA 
Rosenberg^ led to investor losses. For Moody s, model risk was related to reputational and 
liquidity risk because the model errors had been discovered prior to being made public and 
coincided with a change in ratings methodology that resulted in no change to the ratings 
of certain products. As a result, Moody’s was suspected of tailoring its model to the desired 
ratings, which damaged the company’s reputation. For AXA Rosenberg, the discovery of the 
model error had not been made public in a timely manner, leading to both regulatory fines 
and considerable reputational damage to the firm. 


1. AXA Rosenberg Group, LLC is a division of the French insurance company AXA. 
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Model errors in securities valuations or in hedging can create losses within a firm and 
lead to market risk and operational risk. Market risk is the risk of buying overvalued (or, 
at a minimum, fairly valued) securities in the market that are thought to be undervalued. 
Operational risk is the risk of recording unprofitable trades as profitable. 

Relying on market prices rather than model prices through marking positions to market can 
theoretically avoid model errors and reduce valuation risk. A problem with this approach, 
however, is that certain positions, including long-term bank commercial loans, are difficult 
to mark-to-market due to infrequent trading and complexities in valuation. 


Variability of VaR Estimates 


LO 53.2: Explain how model risk and variability can arise through the 
implementation of VaR models and the mapping of risk factors to portfolio 
positions. 


Risk management is typically implemented via computer systems that help to automate 
gathering data, making computations, and generating reports. These systems can be made 
available commercially, and are typically used by smaller firms, while larger firms tend 
to use their own in-house systems, often in combination with commercial models. The 
implementation process for computing risk is usually referred to as the firms VaR models 
although the general computation process can apply to any risk measure other than VaR. 

Data preparation is crucial in risk measurement systems. There are three types of data 
involved: 

1. Market data is time series data (usually asset prices) that is used in forecasting the 
distribution of future portfolio returns. Market data involves obtaining the time series 
data, removing erroneous data points, and establishing processes for missing data. All of 
these steps can be costly but necessary. 

2. Security master data is descriptive data on securities, including maturity dates, 
currency, and number of units. Building and maintaining data for certain securities, 
including equities and debt, can be challenging; however, it is critical from a credit risk 
management perspective. 

3. Position data matches the firms books and records but presents challenges as data must 
be collected from a variety of trading systems and across different locations. 

Once the data is collected, software is used to compute the risk measures using specific 
formulas, which are then combined with the data. Results are then published in documents 
for reporting by managers. All of these steps can be performed in numerous ways and can 
lead to several issues within the risk measurement system. We focus on two of these issues: 
the variability of the resulting measures and the appropriate use of data. 

Variability in risk measures, including VaR, is both a benefit and a problem. Managers have 
significant discretion and flexibility in computing VaR, and parameters can be freely used in 
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many different ways. This freedom in measuring VaR leads to two significant problems in 
practice: 

1. Lack of standardization of VaR parameters. Given the variability in VaR measurements 
and managers’ discretion, parameters including confidence intervals and time horizons 
can vary considerably, leading to different measurements of VaR. 

2. Differences in VaR measurements. Even if VaR parameters were standardized, differences 
in measuring VaR could lead to different results. These include differences in the 
length of the time series used, techniques for estimating moments, mapping techniques 
(discussed in the next section) and the choice of risk factors, decay factors in using 
exponentially weighted moving average (EWMA) calculations, and the number of 
simulations in Monte Carlo analysis. 

Varying parameters can lead to materially different VaR results. For example, one study 
using different combinations of parameters, all within standard practice, of portfolios 
consisting of Treasury bonds and S&P 500 index options indicated that VaR results differed 
considerably by a factor of six or seven times. A simple read of the different VaR models 
published in the annual reports of some of the larger banks can give an indication of the 
variability in their measurements. 


Risk Factor Mapping for VaR Calculations 

Mapping refers to the assignment of risk factors to positions. Mapping choices can also 
impact VaR results. These could include practical choices among alternatives where each 
alternative has its benefits and disadvantages. For example, managers have a choice between 
cash flow mapping and duration-convexity mapping for fixed income securities. Cash flow 
mapping leads to greater accuracy (each cash flow is mapped to a fixed income security with 
an approximately equal discount factor); however, duration-convexity mapping fewer 

and less complex computations, reducing costs and potential data errors as well as model 
risks. 

It may also be difficult to locate data that addresses specific risk factors. One example is the 
previously widespread practice of mapping residential mortgage-backed securities (RMBS) 
or other securitized products to corporate credit spreads of the same rating. Because data 
on securitization spreads is typically not widely available, using a proxy risk factor of 
generic corporate bond spreads can be misleading, especially since previously lower spreads 
on securitizations widened considerably more during the recent financial crisis than did 
corporate spreads. This is an example of model risk and the inefficiency of VaR estimates in 
modeling large movements in market prices. 

Incorrect mapping to risk factors can create risks such as liquidity risk and basis risk. 
Liquidity risk arises from divergences in model and market prices. For example, convertible 
bonds can be mapped to risk factors including implied volatilities, interest rates, and credit 
spreads based on the theoretical (model) price of the convertible bond using a replicating 
portfolio. However, significant divergences in model and market prices are difficult to 
capture with market data, and as a result, VaR estimates based on the replicating portfolio 
can considerably understate risk, creating liquidity risk. 
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Basis risk is the risk that a hedge does not provide the required or expected protection. Basis 
risk arises when a position or its hedge is mapped to the same set of risk factors, which can 
be done when it is difficult to distinguish between two closely related positions. While this 
results in a measured VaR of zero, the positions have significant basis risk. Basis risk is also 
present in the risk modeling of securitization exposures where securitizations are hedged 
with corporate credit default swap (CDS) indices of similar ratings. 

Other strategies can also lead to misleading VaR estimates. For example, event-driven 
strategies have outcomes that are close to binary and depend on a specific event occurring, 
including mergers or acquisitions, bankruptcy, or lawsuits. For these trades, the range of 
results cannot be measured based on historical return data. Dynamic strategies are another 
example, where risk is generated over time rather than at a specific point in time. 

Credit Market in Early 2005 


LO 53.3: Identify reasons for the failure of the long-equity tranche, short- 
mezzanine credit trade in 2005 and describe how such modeling errors could have 
been avoided. 


Credit Trade Description and Modeling Issues 

Volatility in credit markets in the spring of 2005 caused significant modeling errors from 
both misinterpretation and incorrect application of models. Trades incurred losses as only 
certain dimensions of risks were hedged, while others were ignored. 

A popular strategy in credit markets for hedge funds, banks, and brokerages was to sell 
protection on the equity tranche and buy protection on the junior (mezzanine) tranche of 
the CDX.NA.IG index, the investment-grade CDS index. As a result, the trade was long 
credit and credit spread risk on the equity tranche and short credit and credit spread risk 
on the mezzanine tranche. The trade was primarily executed on the IG3 and IG4 index 
series. The trade was designed to be default-risk neutral at initiation with equal credit spread 
sensitivities on the two legs. The motivation of the trade was to have a positively convex 
payoff profile with the two positions benefiting from credit spread volatility, while earning 
a positive net spread on the positions (positive carry). This allowed trades to have a position 
similar to delta-hedged, long option portfolios by receiving, rather than paying, time value. 

The hedge ratio for the delta-hedged portfolio then determined the dollar amount of the 
mezzanine to be shorted for every dollar of the long equity. In other words, the hedge ratio 
was the ratio of the profit and loss impact of a 1 bp widening of the CDX index on the 
equity and mezzanine tranches. The proper hedge ratio then allowed for the creation of a 
portfolio based on the CDX index that, at the margin, was default-risk neutral. The CDX 
trade benefited from a large change in credit spreads and essentially behaved like an option 
straddle on credit spreads with an option premium paid to the owner of the option. The 
hedge ratio for the CDX index was around 1.5 to 2 in early 2005, which resulted in a net 
flow of spread income to the long equity/short mezzanine trade. 
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The critical error in the trade, however, was that it was set up at a specific value of implied 
correlation. A static correlation was considered a critical flaw as the deltas that were used in 
setting up the trade were partial derivatives that ignored any changes in correlation. With 
changes in credit markets, changing correlations doubled the hedge ratio to close to 4 by 
the summer of 2005. As a result, traders now needed to sell protection on nearly twice the 
notional value of the mezzanine tranche to maintain portfolio neutrality. Stated differently, 
as long as correlations remained static, the trade remained profitable. However, once 
correlations declined and spreads did not widen sufficiently, the trade became unprofitable. 

Therefore, while the model did not ignore correlation, it assumed a static correlation and 
instead focused on anticipated gains from convexity. The error could have been corrected 
by stress testing correlation or by employing an overlay hedge of going long, single-name 
protection in high default-probability names. 

Credit Market Example 

Problems in credit markets were already evident by the spring of 2005. The problems 
were largely related to the automobile industry, specifically the original equipment 
manufacturers (OEMs), including Ford, Chrysler, and General Motors (GM), which had 
been experiencing troubles for some time. OEMs were particularly important in the U.S. 
investment-grade bond market, and the emerging threat of a downgrade to junk status 
rattled markets. Although the OEMs were not directly part of the CDX.NA.IG index, 
several of their related finance companies were. Outside of OEMs, several auto parts 
manufacturers were included in two series of the index, the IG3 and IG4 indices. 

The immediate priority of the OEMs in early 2005 was to secure a relief from the United 
Auto Workers (UAW) union of health benefit commitments to retirees. When GM and 
the UAW were unable to reach an agreement in the spring of 2005, which coincided with 
the announcement of large losses for GM, GM and Ford were downgraded to junk status 
by S&P and Moody’s. This created a sharp widening of corporate spreads, including the 
spreads on the automotive finance companies and other industry names. Several auto parts 
manufacturers filed for Chapter 11 bankruptcy protection. As a result, the market was now 
anticipating the possibility of defaults in the IG3 and IG4 indices, and the probability of 
extreme losses became real. In addition, the convertible bond market was also experiencing 
a selloff that resulted in widening of spreads. The IG indices widened in line with the credit 
spread widening of the index constituents. The mark-to-market value and the implied 
correlation of the equity tranche dropped sharply. The implied correlation fell given that 
(1) the auto parts supplier bankruptcies were in the IG4 series, which led to close to 10% of 
the portfolio now close to default, and (2) the widening of the IG4 series was constrained 
by hedging, which led to a fall in correlation. Participants could hedge short credit positions 
in the equity tranche by selling credit protection on the mezzanine tranche or the IG4 index 
series. Concurrently, the mezzanine tranche saw a small widening as market participants 
were covering their positions by selling protection on the mezzanine tranche (that is, they 
were taking on credit risk). These events led to the unwinding of the equity/mezzanine 
tranche trade with the relative value trade experiencing large losses. 
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LO 53.4: Explain major defects in model assumptions that led to the 
underestimation of systematic risk for residential mortgage backed securities 
(RJMBS) during the 2007-2009 financial downturn. 


The subprime RMBS valuation and risk models have been widely employed by credit rating 
agencies to assign bond ratings, by traders and investors in bond valuations, and by issuers 
in structuring RMBS. During the 2007-2009 financial downturn, two major defects in 
model assumptions became apparent: 

1. Assumption of future house price appreciation. The RMBS risk model generally assumed 
that future house prices would rise, or at least not fall, based on relatively few historical 
data points. When house prices actually did drop beginning in 2007, this incorrect 
assumption led to a significant underestimation of the potential default rates and 
systematic risk in RMBS because the credit quality of the loans was dependent on 
borrowers’ ability to refinance without additional equity. 

2. Assumption of low correlations. The RMBS model assumed low correlations among 
regional housing markets, implying that loan pools from different geographical regions 
were well diversified. When house prices declined, correlations increased and loan 
defaults were much higher than previously expected under the model stress scenarios. 

These two model errors led to a significant underestimation of systematic risk in subprime 
RMBS returns. When mortgage default rates began to increase, rating agencies were 
required to downgrade most issues, and by the end of 2009, approximately 45% of the 
initially AuAA-rated U.S. RMBS had been downgraded. The downgrades of RMBS from 
their AAA-equivalent ratings shocked markets and exposed the degree to which systemic 
risk had been underestimated and mispriced. 

There have been several explanations proposed for the inaccuracy of the rating models. 

First, the compensation of rating agencies by bond issuers led to a potential conflict of 
interest scenario that resulted in lower ratings standards. Second, an increase in demand 
for higher rated bonds with a modestly higher yield resulted in searching for yield. Finally, 
mapping problems led to misleading risk measurement results, as highly rated securitized 
products were frequently mapped to highly rated corporate bond spread indices. This 
resulted in incorrect VaR estimates, as incorrect mappings indicated it would be unlikely 
that bonds would decline significantly in value. In reality, the most highly rated RMBS lost 
a significant portion of their value, declining close to 70% during the subprime crisis, while 
lower investment-grade RMBS lost virtually all of their value. 
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Key Concepts 


L0 53.1 

Model risk is the risk of incorrect trading or risk management decisions due to errors 
in models and model applications, which can lead to trading losses and potential legal, 
reputational, accounting, liquidity, and regulatory risk. Errors can be introduced into 
models through programming bugs, securities valuations or hedging, VaR estimates, and 
position mappings. 


LO 53.2 

Firms use software to compute the risk measures from the data collected using specific 
formulas, which can be performed in a variety of ways and lead to potential issues. 
Variability in risk measures, including lack of uniformity in the use of confidence intervals 
and time horizons, can lead to variability in VaR estimates. Other factors can also 
cause variability, including length of time series, ways of estimating moments, mapping 
techniques, decay factors, and number of simulations. 

Mapping refers to the assignment of risk factors to positions, and mapping choices can 
considerably impact VaR results. 

Cash flow mapping results in greater accuracy of estimates. Duration-convexity mapping 
requires fewer risk factors and less complex computations, which reduces costs, data errors, 
and model risks. Locating data that addresses specific risk factors may also be difficult. 

Liquidity risk arises from large divergences in model and market prices that are difficult to 
capture with market data, and as a result, VaR estimates based on replicating portfolios can 
understate risk and create liquidity risk. 

Basis risk is the risk that a hedge does not provide the required or expected protection. Basis 
risk arises when a position or its hedge is mapped to the same set of risk factors. 


LO 53.3 

Volatility in credit markets in the spring of 2005 fueled by company bankruptcies and losses 
led to defaults in the IG3 and IG4 index series of the CDX.NA.IG index, causing large 
selloffs that resulted in widening spreads. This also resulted in modeling errors from both 
misinterpretation and incorrect application of models, which led to trade losses. 


LO 53.4 

Two significant model errors in the RMBS valuation and risk models led to a significant 
underestimation of systematic risk in subprime RMBS returns during 2007-2009. First, 
the RMBS risk model assumed future house prices to rise or at least stay flat. The eventual 
decline in house prices starting in 2007 led to a significant underestimation of the potential 
default rates and systematic risk in RMBS. Second, the RMBS model assumed low 
correlations among regional housing markets. When house prices declined, correlations and 
loan defaults increased. 
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Concept Checkers 


1. Due to a recently discovered error in its valuation model, Samuelson, Inc. had 
previously recorded certain trades as profitable even though the positions were 
unprofitable. The risk that best characterizes this error is: 

A. operational risk. 

B. liquidity risk. 

C. market risk. 

D. hedge risk. 

2. Duane Danning is a junior risk analyst at a large risk management firm. He has 
been asked to assess the firms risk modeling practices and evaluate potential ways 
in which errors could be introduced into models. In his analysis, Danning indicates 
that errors can be introduced into models through programming bugs and errors in 
VaR estimates but rarely through incorrect position mappings. Danning s analysis is 
most accurate with regard to: 

A. only programming bugs and incorrect position mappings. 

B. only programming bugs and errors in VaR estimates. 

C. only errors in VaR estimates. 

D. only incorrect position mappings. 

3. An advantage of duration mapping over cash flow mapping is that duration 
mapping: 

A. is more accurate than cash flow mapping, thus reducing mapping errors. 

B. uses cash flows that are mapped to specific fixed income securities without the 
use of approximations. 

C. uses more complex computations, thus reducing data errors and model risk. 

D. uses fewer risk factors, thus reducing data errors and model risk. 

4. A common trade during 2004 and 2005 was to sell protection on the equity tranche 
and buy protection of the mezzanine tranche of the CDX.NA.IG index. Which of 
the following statements regarding this trade is least accurate? 

A. The trade was set up to be default-risk neutral at initiation. 

B. The trade was short credit spread risk on the equity tranche and long credit 
spread risk on the mezzanine tranche. 

C. The main motivation for the trade was to achieve a positively convex payoff 
profile. 

D. The trade was designed to benefit from credit spread volatilities. 
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5. Which of the following two model errors in the RMBS valuation and risk models 
are considered to have contributed the most to a significant underestimation of 
systematic risk in subprime RMBS returns during 2007-2009? 

A. The assumption of future house price appreciation and the assumption of high 
correlations among regional housing markets. 

B. The assumption of future house price declines and the assumption of high 
correlations among regional housing markets. 

C. The assumption of future house price appreciation and the assumption of low 
correlations among regional housing markets. 

D. The assumption of future house price declines and the assumption of low 
correlations among regional housing markets. 
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Concept Checker Answers 


1. A Recording trades as profitable that have, in fact, lost money is an example of operational risk. 

2. B Dannings analysis is most accurate with regard to only programming bugs and errors in VaR 

estimates. Incorrect position mappings can also lead to material errors in risk models. 

3. D Duration mapping (or duration-convexity mapping) requires the use of fewer risk factors 

and less complex computations, thus reducing costs, data errors, and model risks. Cash flow 
mapping results in greater accuracy of estimates, however, because cash flows are mapped to 
specific fixed income securities without the use of approximations. 

4. B The trade was long credit and credit spread risk on the equity tranche and short credit and 

credit spread risk on the mezzanine tranche. The other statements are accurate. 

5. C The two model errors considered to have contributed the most to a significant 

underestimation of systematic risk were (1) the assumption of future house price 
appreciation, and (2) the assumption of low correlations among regional housing markets. 
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The following is a review of the Operational and Integrated Risk Management principles designed to address 
the learning ohjectives set forth hy GARP®. This topic is also covered in: 

Liquidity and Leverage 


Topic 54 

Exam Focus 

This topic analyzes the effects of liquidity and leverage on firm risk. For the exam, 
understand the distinction between transactions liquidity and funding liquidity, and the role 
banks play in providing liquidity. Also, be able to calculate a firms leverage ratio and the 
leverage effect, and know how to construct the economic balance sheet given trades such as 
buying stock on margin, selling stock short, and taking positions in derivatives. Finally, be 
able to explain tightness, depth, and resiliency as they relate to liquidity risk. 


Sources of Liquidity Risk 


LO 54.1: Differentiate between sources of liquidity risk, including balance sheet/ 
Rinding liquidity risk, systematic funding liquidity risk, and transactions liquidity 
risk, and explain how each of these risks can arise for financial institutions. 

LO 54.9: Explain interactions between different types of liquidity risk and explain 
how liquidity risk events can increase systemic risk. 


Liquidity is defined in many ways in financial markets. In general, an asset is liquid if it is 
“close to cash.” This means that the asset can be sold quickly, cheaply, and without moving 
the price “too much.” A market is liquid if positions can be unwound quickly, cheaply 
(i.e., at low transactions costs), and without undue price deterioration. 

Liquidity has two essential properties, which relate to two essential forms of risk. 
Transactions liquidity deals with financial assets and financial markets. Funding liquidity is 
related to an individual s or firms creditworthiness. Risks associated with liquidity include: 

• Transactions (or market) liquidity risk is the risk that the act of buying or selling an 
asset will result in an adverse price move. 

• Funding liquidity risk or balance sheet risk results when a borrowers credit position 
is either deteriorating or is perceived by market participants to be deteriorating. It also 
occurs when the market as a whole deteriorates. Under these conditions, creditors may 
withdraw credit or change the terms of credit (e.g., increase the required collateral for 
the loan). The position may, as a result, be unprofitable or may need to be unwound. 
Balance sheet risks are higher when borrowers fund longer term assets with shorter term 
liabilities. This is called a maturity mismatch. Maturity mismatching is often profitable 
for firms because short-term investors bear less risk and have a lower required rate of 
return. This means that short-term debt financing contributes less to the overall cost of 
capital of a borrowing firm. The incentive to maturity mismatch is even greater when 
the yield curve is upward sloping. However, funding long-term assets with short-term 
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financing exposes the borrower to rollover risk (sometimes called cliff risk), the risk that 
the debt cannot be refinanced or can only be refinanced at escalating rates. 

• Systemic risk is the risk that the overall financial system is impaired due to severe 

financial stress. With this risk, credit allocation is impaired across the financial system. 

Risks associated with liquidity are interrelated and can exacerbate problems. For example, 
if collateral requirements are increased, a counterparty may be forced to unwind a position 
early and at a potential loss. In this case, the increase in funding liquidity risk increases the 
transactions liquidity risk. 

Ail important connection between funding and transactions liquidity is leverage. Aii 
investor with a long position may be forced to sell an asset if future funding for the asset 
dries up. This in turn would reduce the number of potential asset holders, leading to a 
reduction in asset valuation. It may be the case that this decline in price is temporary, 
however, the length of the depressed asset price could be long enough to adversely impact 
the solvency of the investor who initially purchased the asset. A rapid deleveraging of assets 
could lead to a “debt-deflation crisis.” 

Transactions liquidity could also impair funding liquidity. For example, if a hedge fund 
is facing redemptions, it is forced to raise cash by selling assets and therefore must decide 
which assets to sell first. Selling highly liquid assets will lead to fewer adverse price impacts, 
but will leave the hedge fund with a more illiquid portfolio. On the other hand, selling 
highly illiquid assets will increase realized losses, which may put additional pressure on the 
portfolio from a funding liquidity standpoint. 

The level of economy-wide liquidity directly impacts the level of systemic risk. When 
market conditions deteriorate, liquidity tends to become constrained just when investors 
need it the most. Liquidity risk events could potentially become systemic risk events 
through disruptions in payment, clearing, and settlement systems. Severe stress to the 
financial system would impact market participants simultaneously, suggesting that the 
illiquidity or insolvency of one counterparty may have a domino effect on other market 
participants throughout the system. 


Liquidity Transformation by Banks 


LO 54.2: Summarize the asset-liability management process at a fractional reserve 
bank, including the process of liquidity transformation. 


Commercial bank assets are typically longer-term and less liquid than bank liabilities 
(e.g., deposits). Wholesale funding (i.e., non-deposit sources of funding like commercial 
paper, bonds, and so on) is generally longer term but deposits are “sticky.” Depositors 
generally change banks only if impelled to by a move or some other extenuating 
circumstance. Deposits make up approximately 60% of bank liabilities in the United States. 

Banks only expect a fraction of deposits and other liabilities to be redeemed at any point 
in time. As a result, they do not hold all the deposits in liquid assets, but make loans 
with deposits instead. For example, a bank might take in $100 of deposits, hold $10 for 
redemptions, and lend the remaining $90. This is known as a fractional-reserve bank 
and the process of using deposits to finance loans is known as asset-liability management 
(ALM). 
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The bulk of banks in history have been fractional-reserve banks. The alternative to a 
fractional-reserve system is one in which the bank uses owners money (i.e., equity) or 
money raised in capital markets to make loans, and keeps in reserve cash or highly liquid 
assets equal to its deposits. 

If withdrawals are greater than the banks reserves, the bank is forced into a suspension of 
convertibility. This means the bank will not be able to, as expected by depositors, convert 
deposits immediately into cash. In the extreme, there may even be a run on the bank. In the 
case of a bank run, depositors who are concerned about bank liquidity may attempt to get 
money out of the bank before other depositors and lenders. While rollover risk associated 
with other short-term financing is less extreme than bank runs, it does increase the fragility 
of banks. Higher capital reduces bank fragility. 

Frozen commercial paper markets in the wake of the Lehman Brothers failure illustrated the 
fragility of bank funding. Commercial funding couldn’t be placed and thus fell dramatically 
after the Lehman bankruptcy. It became nearly impossible to roll over longer term paper 
and very short-term paper rose to account for approximately 90% of the market. The 
Federal Reserve stepped in after the Lehman bankruptcy and created the Commercial Paper 
Funding Facility (CPFF) and the Asset-Backed Commercial Paper Money Market Mutual 
Fund Liquidity Facility (AMLF). 

Structured Credit Products and Off-Balance Sheet Vehicles 

Structured credit products, such as asset-based securities (ABSs) and mortgage-backed 
securities (MBSs), match investor funding needs with pooled assets. Because these products 
are maturity matched, they are not subject to funding liquidity issues. However, investor 
financing for structured credit products can create liquidity risk when investors rely on 
short-term financing. This type of financing was one of the main drivers of the recent 
subprime crisis and the increase in leverage in the financial system leading up to the crisis. 
Two types of short-term financing include: (1) securities leading (i.e., applying structured 
credit products as collateral to short-term loans), and (2) off-balance sheet vehicles. 

Special-purpose vehicles (SPVs) serve as off-balance sheet vehicles by issuing secured debt in 
the form of asset-backed commercial paper (ABCP). ABCP conduits finance purchases of 
assets, such as securities and loans, with ABCP. They receive liquidity and credit support via 
credit guarantees. Structured investment vehicles (SIVs) differ slightly from ABCP conduits 
because they do not receive full liquidity and credit support. 

Prior to the subprime crisis, both ABCP conduits and SIVs profited from the spread 
between funding costs and asset yields. The assets held by these vehicles typically had longer 
maturities than the ABCP that fund the assets. In addition to maturity transformation, 
these vehicles also provided liquidity transformation. This was accomplished by creating 
ABCP that was more liquid and had shorter terms than the assets held in the conduit and 
SIV. However, despite being off-balance sheet, which permitted firms to hold less capital, 
these vehicles did not entirely transfer risk. As a result, they still contributed to the leverage 
issues and fragility of the financial system during the recent subprime crisis. 
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LO 54.3: Describe specific liquidity challenges faced by money market mutual 
funds and by hedge funds, particularly in stress situations. 


Systematic funding risks were apparent in many market sectors during the subprime 
mortgage crisis. As loans become shorter term, lenders and borrowers are exposed to greater 
liquidity risks. Borrowers must be able to refinance in order to repay short-term loans. The 
risk is systematic in that it affects borrowers and lenders at the same time. 

Liquidity issues arose during the recent financial crisis for a variety of investment strategies 
including: 

• Leveraged buyouts (LBOs). Leveraged loans became the dominate type of syndicated 
bank loans as LBOs and private equity grew before the crisis. Leveraged loans accounted 
for a large part of collateralized loan obligations (CLOs) and collateralized debt 
obligations (CDOs), which provided funding for LBOs. During the subprime mortgage 
crisis, LBO deals fell apart as funding dried up. Some loans, called “hung loans,” had not 
been distributed to investors and demand dried up. Banks incurred significant losses as 
prices fell sharply. 

• Merger arbitrage hedge funds. Hedge funds engaged in merger arbitrage experienced 
losses in the early stages of the subprime mortgage crisis. After a merger is announced, 
the targets stock price typically increases and the acquirers price sometimes declines 
due to increased debt. The merger arbitrage strategy exploits the difference between 
the current and announced acquisition prices. Hedge funds experienced large losses as 
mergers were abandoned when financing dried up. 

• Convertible arbitrage hedge funds. Convertible arbitrage strategies rely on leverage 
to enhance returns. Credit is extended by broker-dealers. When financing becomes 
unavailable due to market conditions, as experienced in the 2007—2009 financial 
crisis, convertible bond values drop precipitously. The funding liquidity problem was 
compounded by redemptions (i.e., a market liquidity problem). Also, because there is 
a limited clientele investing in convertible bonds, when the clientele develops a dislike 
for the product due to deteriorating market conditions, it is difficult to sell the assets 
without large price declines. The gap between convertible bond prices and replicating 
portfolios widened dramatically during the financial crisis, but it still did not bring 
arbitrage capital into the market. 

The broader point is that investment strategies, such as merger arbitrage, convertible 
arbitrage, and leveraged buyouts, are not only exposed to idiosyncratic risks, but also to 
systematic risks (i.e., systematic funding risks in this case). The risks are soft risks because 
they are difficult to relate to a particular series of asset returns. Instead, analysts must 
examine data on credit and liquidity spreads as well as quantitative and anecdotal data on 
the availability of credit in the market to understand the probability of a liquidity freeze. 

Money market mutual fund (MMMF) investors can write checks and make electronic bank 
transfers. Like banks, MMMFs are obligated to repay investors/depositors on demand. In 
general, underlying MMMF assets are high credit quality instruments with short maturities 
(e.g., a few weeks to a few months). However, the values of the underlying assets in the 
fund, despite their relative safety, are subject to change. As such, redemptions may be 
limited if asset values fall. The liabilities of MMMFs are, therefore, more liquid than their 
investments, similar to banks. 
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MMMFs use a form of accounting called the amortized cost method, under the Securities 
and Exchange Commissions (SEC) Rule 2a - 7. This means that MMMF assets do not 
have to be marked-to-market each day, as required for other types of mutual funds. The 
reason behind the difference is that extremely short-term securities are not likely to revalue 
based on changes in interest rates and credit spreads. MMMFs set a notional value of each 
share equal to $1.00. However, credit write-downs cannot be disregarded and it is possible 
for net asset values (NAVs) to fall below $1.00. This is known as breaking the buck. 

Liquidity risk can also cause NAVs to fall below $1.00. MMMFs, like depository 
institutions, are subject to runs. If a large proportion of investors try to redeem shares in 
adverse market conditions, the fund may be forced to sell money market paper at a loss. 
This can potentially result in write-downs and breaking the buck. 

Economics of the Collateral Market 


LO 54.4: Compare transactions used in the collateral market and explain risks that 
can arise through collateral market transactions. 


Collateral markets have two important purposes. First, they enhance the ability of firms to 
borrow money. Cash is only one type of asset that is borrowed. Securities are also borrowed 
in collateral markets. Second, collateral markets make it possible to establish short positions 
in securities. 

Firms with excess cash are more willing to lend at a low rate of interest if the loan is secured 
by collateral. Securities are used as collateral for secured loans. Collateralized loans can be 
short term or longer term. Overnight loans are often extended automatically. The full value 
of the securities is not lent in a collateralized loan. The difference is called a haircut. For 
example, a lender may be willing to lend $95 against $100 of collateral. 

Collateral values fluctuate and most collateralized borrowing arrangements require that 
variation margin be paid to make up the difference (called remargining). Variation margin 
is the additional funds a broker requests so that the initial margin requirement keeps 
up with losses. The haircut ensures that the value of the collateral can fall by a certain 
percentage (i.e., 5% in the previous example) and still leave the loan fully collateralized. The 
variation margin protects the lender. 

Collateralized loans are used to finance securities or other assets or trades. The securities 
pledged to one firm are often loaned or pledged again, hence the collateral circulates. This 
process is known as rehypothecation or repledging. 

The role of collateral has expanded in contemporary finance, hand-in-hand with the 
development of securitization. Securitization creates securities that can be pledged as 
collateral for credit. Securitized assets generate cash flows, may appreciate in value, and can 
be used as collateral for other transactions. 

Life insurance companies own large portfolios of high-quality assets. They may use these 
assets for collateralized loans to borrow at low rates and reinvest at higher rates. Hedge 
funds pledge securities to finance portfolios at rates cheaper than unsecured loans. 
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Markets for collateral take the following forms: 

• Margin loans. Margin loans are used to finance security transactions. The margin loan 
is collateralized by the security and is often provided by the broker intermediating the 
trade. The broker maintains custody of the securities in a street name account 

(i.e., securities are registered in the name of the broker rather than the owner). This 
structure makes it easier to seize and sell securities to meet margin calls. An added 
advantage to the broker is that securities in street name accounts can be used for other 
purposes, such as lending to other customers for short sales. In practice, the broker uses 
the customers collateral to borrow money in the money market to provide margin loans 
to customers. The margin loan to the broker is collateralized by the repledged customer 
collateral. The Federal Reserves Regulation T sets the initial margin requirement for 
securities purchases at 50%. Cross-margin agreements are used to establish the net 
margin position of investors with portfolios of long and short positions. In general, 
cross margin involves transferring excess margin in one account to another account with 
insufficient margin, resulting in lower overall margin for the investor. 

• Repurchase agreements or repos. Repurchase agreements, also known as repos and RPs, 
are another form of collateralized short-term loans. They involve the sale of a security 

at a forward price agreed upon today. The interest on the loan is implied from the 
difference between spot and forward prices of the securities. While traditionally collateral 
had little or no credit risk (collateral was usually Treasury bills), today acceptable 
collateral encompasses whole loans, high-yield bonds, and structured credit products. 
Repos allow banks and other firms to finance inventories of structured credit products 
and allow for high investment grade ratings for senior tranches of asset-backed securities 
(ABSs) and collateralized debt obligations (CDOs). 

• Securities lending. Securities lending involves the loan of securities to another party 
in exchange for a fee, called a rebate. The lender of the securities continues to receive 
the dividends and interest cash flows from the securities. Lenders of securities are often 
hedge funds or other large institutional investors of equities. Securities are held in street 
name accounts to make them available for lending to traders who want to short stocks. 
Fixed income securities lending typically involves the loan of Treasury securities for cash. 
The cash is invested in a higher risk bonds and the investors objective is to earn the 
spread between the two. 

• Total return swaps. In a total return swap (TRS), one party pays a fixed fee in exchange 
for the total return (both income and capital gains) on a reference asset, typically a stock. 
The advantage is that the party paying the fee can earn the return from the underlying 
asset without owning the asset. The party providing the return (such as a hedge fund) is, 
in essence, short the asset. 


Professor's Note: Securities lending, like repurchase agreements, are often structured 
as sales of securities, not loans of securities, so the holder of the collateral can 
rehypothecate the securities, or even sell them in a timely fashion if the loan is not 
repaid. 
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Leverage Ratio and Leverage Effect 


LO 54.5: Describe the relationship between leverage and a firms return profile, 
calculate the leverage ratio, and explain the leverage effect. 


A firms leverage ratio is equal to its assets divided by equity (total assets / equity). That is: 

EE E 

For an all-equity financed firm, the ratio is equal to 1.0, its lowest possible value. As debt 
increases, the leverage ratio (i.e., multiplier) increases. For example, a firm with $100 of 
assets financed with $50 debt and $50 equity has a leverage ratio equal to 2.0 
($100/$50 = 2). 

Return on equity (ROE) is higher as leverage increases, as long as the firms return on assets 
(ROA) exceeds the cost of borrowing funds. This is called the leverage effect. The leverage 
effect can be expressed as: 




where: 

r^ = return on assets 
tg = return on equity 
tj) = cost of debt 
L = leverage ratio 

It may help to think of this formula in words as follows: 


ROE = (leverage ratio x ROA) - [(leverage ratio - 1) x cost of debt] 


For a firm with a zero cost of debt, return on equity is magnified by the leverage factor; 
however, debt is not free. Thus, return on equity (ROE) increases with leverage, but the 
cost of borrowing, because there is more debt, also increases. The L - 1 factor multiplies the 
cost of debt by the proportion of the balance sheet financed with debt. For example, with a 
leverage ratio of 2, 50% of the balance sheet is financed with debt and 50% with equity. So 
for every $2 of assets, $1 comes from shareholders and $1 comes from borrowed funds. We 
multiply the cost of debt by 1 in this case. If the leverage ratio is 4, 25% is financed with 
equity and 75% is financed with debt. Thus, for every $4 of assets, $1 is equity and $3 is 
borrowed funds. In the formula, we multiply the cost of debt by 3. The higher the leverage 
factor, the bigger the multiplier but also the higher the debt costs. Leverage amplifies gains 
but also magnifies losses. That is why leverage is often referred to as a double-edged sword. 
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ar£/aL = r^-ro 
where: 

9r£= change in retained earnings 
dL = change in the leverage ratio 

This formula implies that, given a change in the leverage ratio, ROE changes by the 
difference between ROA and the cost of debt. 

The equity in the denominator of the leverage ratio depends on the entity. If it is a bank, it 
may be the book value of the firm. It might also be calculated using the market value of the 
firm. The net asset value (NAV) of a fund is the appropriate denominator for a hedge fund. 
The NAV reflects the current value of the investors’ capital in the fund. 


Example: Computing firm ROE (total assets = $2) 

Martin, Inc., a U.S. manufacturing company, has an ROA equal to 5%, total assets equal 
to $2, and equity financing equal to $1. The firm’s cost of debt is 2%. Calculate the firm’s 
ROE. 

Answer: 

r£ = [(2 / 1) X 5%] - [(2 - 1) X 2%] = 8% 


Example: Computing firm ROE (total asset = $4) 

Martin, Inc., a U.S. manufacturing company, has an ROA equal to 5%, total assets equal 
to $4, and equity financing equal to $1. The firm’s cost of debt is 2%. Calculate the firm’s 
ROE. 

Answer: 

r£ = [(4 / 1) X 5%] — [(4 — 1) X 2%] = 14% 

Given a cost of debt of 2%, increasing the leverage factor from 2 to 4 increased the firm’s 
ROE from 8% to 14%. 
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Leverage is also influenced by the firms hurdle rate (i.e., required ROE). For example, 
assume a firms hurdle rate (i.e., ROE) is 10%, ROA equals 6%, and its cost of debt equals 
2%. The firm will choose a leverage ratio of 2.0. That is: 


ROE = (2 X 6%) - (1 X 2%) = 10% 


Explicit and Implicit Leverage 


LO 54.6: Explain the impact on a firms leverage and its balance sheet of the 
following transactions: purchasing long equity positions on margin, entering into 
short sales, and trading in derivatives. 


Purchasing stock on margin or issuing bonds are examples of using leverage explicitly to 
increase returns. However, there are other transactions that have implicit leverage. It is 
important to understand the embedded leverage in short positions and derivatives, such as 
options and swaps. By constructing economic balance sheets for investors and/or firms, it is 
possible to measure the implicit leverage of these transactions. 

Margin Loans and Leverage 

First, consider margin loans. The stock purchased with the margin loan is collateral for 
the loan. The haircut {h) is the borrower s equity and \ — his loaned against the market 
value of the collateral. The leverage is calculated as 1 / /?. The Federal Reserve requires that 
an investor put up a minimum of 50% equity (i.e., h = 50%) in a stock purchase using 
borrowed funds. 

First, assume that a firm has $100 cash invested by the owners (i.e., no borrowed funds). 
The balance sheet in this case is: 


Assets 


Liabilities < 

and Equity 



Debt 

$0 

Cash 

$100 

Equitv 

$100 

Total assets 

$100 

TL and OE 

$100 

If the firm uses 

the cash 

to purchase stock, the balance s 

Assets 


Liabilities 

and Equity 



Debt 

$0 

Stock 

$100 

Equitv 

$100 

Total assets 

$100 

TL and OE 

$100 


Thus, the leverage ratio is equal to 1 (i.e., $100 / $100 or 1.0 / 1.0). 
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Next, assume that the firm uses 50% borrowed funds and invests 50% (i.e., h = 50%) 
equity to buy shares of stock. Immediately following the trade, the margin account balance 
sheet has 50% equity and a $50 margin loan from the broker. That is: 


Assets 


Liabilities 

and Equity 



Margin loan 

$50 

Stock 

$100 

Equitv 

$50 

Total assets 

$100 

TL and OE 

$100 


The full economic balance sheet as a result of the borrowed funds (remember, owners put in 
$100 of equity initially so the firm now has $100 of stock and $50 of cash) is: 


Assets 


Liabilities and Equity 

Cash 

$50 

Margin loan $50 

Stock 

$100 

Equitv $100 

Total assets 

$150 

TLandOE $150 


Thus, the leverage ratio has increased to 1.5 (i.e., $150 / $100 or 1 / 0.667). Note that the 
broker retains custody of the stock to use as collateral for the loan. 

Short Positions and Leverage 

In a short trade, the investor borrows the shares of stock and sells them. The transaction 
lengthens the balance sheet because the cash generated from the short sale along with the 
value of the borrowed securities appear on the balance sheet. 

Assume the firm borrows $100 of stock and sells it short. The firm has an asset equal to the 
proceeds from selling the stock and a liability equal to the value of the borrowed shares. 
However, the firm cannot use the cash for other investments as it is collateral. It ensures that 
the stock can be repurchased and returned to the lender. It is in a segregated short account. 
In the event that the stock price increases rather than decreases, the firm must also put $50 
in a margin account. 

Immediately following the trade, the margin account and short account has $50 equity and 
a $50 margin loan from the broker. 


Assets 


Liabilities and Equity 

$150 due from broker: 




Margin 

$50 

Borrowed stock 

$100 

Short sale proceeds 

$100 

Equitv 


Total assets 

$150 

TL and OE 

$150 
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The firms full economic balance sheet given the short sale is: 


Assets 


Liabilities and Equity 

Cash 

$50 

Borrowed stock 

$100 

Due from broker 

$150 

Equitv 

$100 

Total assets 

$200 

TL and OE 

$200 


Thus, the leverage ratio has increased to 2.0 (i.e., $200 / $100 or 1 / 0.50). The leverage is 
higher in this case than in the previous margin example because the full value of the stock 
is borrowed in a short transaction. Leverage is inherent in the short position but is a choice 
in the long position. The firm only borrows 50% of the balance of the stock in the long 
position. 

If the short position plays a hedging role in the portfolio, the position will reduce market 
risk. This means that leverage will overstate the overall risk because it ignores the potential 
risk reducing benefits of the short positions. As such, a distinction must be made between 
gross and net leverage. Gross leverage is the value of all the assets, including cash generated 
by short sales, divided by capital. Net leverage is the ratio of the difference between the long 
and short positions divided by capital. 

Derivatives and Leverage 

Derivatives allow an investor to gain exposure to an asset or risk factor without actually 
buying or selling the asset. Derivatives also allow investors to increase leverage. Although 
derivatives are generally off-balance sheet, they should be included on the economic balance 
sheet as they affect an investor s returns. Derivatives are synthetic long and short positions. 
To estimate the economic balance sheet, find the cash-equivalent market value for each 
type of derivative. Derivatives include: 

• Futures, forward contracts, and swap contracts. These contracts are linear and 
symmetric to the underlying asset price. The amount of the underlying instrument 
represented by the derivative is set at the initiation of the contract so values can be 
represented on the economic balance sheet by the market value of the underlying asset. 
These contracts have zero net present values (NPVs) at initiation. 

• Option contracts. These contracts have a non-linear relationship to the underlying 
asset price. The amount of the underlying represented by the option changes over time. 
The value can be fixed at any single point in time by the option delta. Thus, on the 
economic balance sheet, the cash equivalent market values can be represented by the 
delta equivalents rather than the market values of the underlying assets. These contracts 
do not have zero NPVs at initiation because the value is decomposed into an intrinsic 
value (which may be zero) and a time value (which is likely not zero). 

In this next example, the counterparty is assumed to be the prime broker or broker-dealer 
executing the positions. This means that margin will be assessed by a single broker on a 
portfolio basis. 
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First, assume the firm enters a 1-month currency forward contract and is short $100 against 
the euro and the 1-month forward exchange rate is $1.25 per euro. The balance sheet is: 


Assets 

Liabilities and Equity 

$100 equivalent of €80 bank deposit 

Broker loan $100 


Now, assume the firm buys a 3-month at-the-money call option on a stock index with 
an underlying index value of $100. The calls delta is currently 50%. The transaction is 
equivalent to using a $50 broker loan to buy $50 of the stock index. That is: 


Assets 


Liabilities and Equity 

$50 long index position 

$50 

Broker loan $50 


Next, assume the firm enters a short equity position via a total return swap (TRS). The firm 
pays the total return on $100 of ABC stock and the cost of borrowing the ABC stock 
(i.e., the short rebate). This is equivalent to taking a short position in ABC. Assuming the 
market price of ABC is $100, we have: 


Assets 


Liabilities and Equity 

$100 due from broker 
(proceeds from short sale) 

$100 

Borrowed ABC stock $ 100 


Finally, assume the firm adds short protection on company XYZ via a 5-year credit default 
swap (CDS) with a notional value of $100. This position is equivalent to a long position in 
a par-value 5-year floating rate note (FRN) financed with a term loan. 

The firms combined economic balance sheet that includes all of the derivatives positions is: 


Assets 


Liabilities and Equity 

Cash 

$50 

Short-term broker loan 

$150 

Due from broker 

$150 



$50 margin 




$100 short sale proceeds 


Term loan 

$100 

Equivalent of €80 bank deposit 

$100 

Borrowed ABC stock 

$100 

Long equity index 

$50 



XYZ FRN 

$100 

Equitv 

$100 

Total assets 

$450 

TL and OE 

$450 


The firm has increased its leverage to 3.5 in its long positions. The long positions combined 
with the short position (the ABC TRS) means the firm has gained economic exposure to 
securities valued at $450 using $50 of cash. 

Notice that computing leverage is complex when derivatives are used. Also, correctly 
interpreting leverage is important since risk may be mitigated if short positions are used 
to hedge. For example, currency and interest rate risks can be hedged accurately. However, 
the positions are of the same magnitude as the underlying assets. If the positions are carried 
on the economic balance sheet, leverage will be overstated and other material risks in the 
portfolio may be ignored. 
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Sources of Transactions Liquidity Risk 


LO 54.7: Explain methods to measure and manage funding liquidity risk and 
transactions liquidity risk. 


An asset is liquid if it resembles money. That is, it can be exchanged for goods or services 
quickly and at a certain value. However, assets have to be liquidated in order to buy goods 
and services because we do not have a barter economy. 

Transactions liquidity implies that an asset can be bought or sold without moving its price. 
However, large transactions may move an asset s price because they create a short-term 
imbalance between supply and demand. Transactions liquidity risk is fundamentally related 
to the costs of searching for a counterparty, the institutions required to assist in that search, 
and the costs of inducing a counterparty to hold a position. 

In order to understand transactions liquidity risk, it is important to understand market 
microstructure fundamentals. These fundamentals are: 

• Trade processing costs. The first cost is associated with finding a counterparty in a 
timely fashion. In addition, processing costs, clearing costs, and the costs of settling 
trades must also be considered. These costs do not typically increase liquidity risk 
except in circumstances, either natural or man-made, where the trading infrastructure is 
affected. 

• Inventory management. Dealers provide trade immediacy to market participants. The 
dealer must hold long or short inventories of assets and must be compensated by price 
concessions. This risk is a volatility exposure. 

• Adverse selection. There are informed and uninformed traders. Dealers must 
differentiate between liquidity or noise traders and information traders. Information 
traders know if the price is wrong. Dealers do not know which of the two are attempting 
to trade and thus must be compensated for this lemons risk through the bid-ask spread. 
The spread is wider if the dealer believes he is trading with someone who knows more 
than he does. However, the dealer does have more information about the flow of trading 
activity (i.e., is there a surge in either buy or sell orders). 

• Differences of opinion. It is more difficult to find a counterparty when market 
participants agree (e.g., the recent financial crisis where counterparties were afraid to 
trade with banks because everyone agreed there were serious problems) than when they 
disagree. Investors generally disagree about the correct or true price on an asset and 
about how to interpret new information about specific assets. 

These fundamentals differ across different types of market organizations. For example, in 
a quote-driven system, common in over-the-counter (OTC) markets, market makers are 
expected to publicly post 2-way prices or quotes and to buy or sell at those prices within 
identified transaction size limits. In contrast, order-driven systems, typically found on 
organized exchanges, are more similar to competitive auction models. Typically the best bids 
and offers are matched throughout the trading session. 

Liquidity risks are introduced when bid-ask spreads fluctuate, when the trader s own actions 
impact the equilibrium price of the asset (called adverse price impact) and when the price 
of an asset deteriorates in the time it takes a trade to get done (called slippage). 
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In general, regulators have focused more on credit and market risks and less on liquidity 
risk. Liquidity risk is difficult to measure. However, since the financial crisis, more attention 
is being paid to measuring liquidity risks in a firm. 


Transactions Cost 


LO 54.8: Calculate the expected transactions cost and the spread risk factor for 
a transaction, and calculate the liquidity adjustment to VaR for a position to be 
liquidated over a number of trading days. 


Assuming that daily changes in the bid-ask spread are normally distributed, the 99% 
confidence interval on the transactions cost in dollars is: 


+/- P X i/2(s + 2.33a^) 
where: 

P = an estimate of the next day asset midprice, usually set to P, the most recent price 
observation 

s = expected or typical bid-ask spread calculated as: (ask price — bid price) / midprice 
Og = sample standard deviation of the spread 

This confidence interval estimates the expected transactions costs in dollar terms. The 
Vi(s + 2.33o‘^) component is referred to as the 99% spread risk factor. 


Example: Computing transactions cost 

Brieton, Inc., recently traded at an ask price of $100 and a bid price of $99. The sample 
standard deviation of the spread is 0.0002. Calculate the expected transactions cost and 
the 99% spread risk factor for a transaction. 

Answer: 

midprice = (100 + 99) / 2 = 99.50 
s = (100-99)/99.5 = 0.01005 

transactions cost = 99.50 x !/2[0.01005 + 2.33(0.0002)] = $0,523 

spread risk factor = i/2[0.01005 + 2.33(0.0002)] = 0.005258 

Note that in this example, we use the current midprice as the estimate for the next day 
asset midprice. 
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Adjusting VaR for Position Liquidity 

Liquidity-adjusted value at risk (LVaR) is a tool used to measure the risk of adverse price 
impact. The trader will often liquidate the position over a period of days in order to ensure 
an orderly liquidation of the position. 


Professors Note: The actual calculation of liquidity-adjusted VaR (using constant 
and exogenous spread approaches) was shown in Topic 52, Here we discuss how VaR 
may be overstated when adjusting for different time horizons (via the square root of 
time rule) since this adjustment does not account for the liquidation ofpositions over 
the time period of analysis. 


Adjusting VaR for liquidity requires an estimate of the number of days it will take to 
liquidate a position. The number of trading days is typically denoted T, Assuming the 
position can be divided into equal parts across the number of trading days and liquidated 
at the end of each trading day, a trader would face a 1-day holding period on the entire 
position, a 2-day holding period on a fraction (T — 1) / T of the position, a 3-day holding 
period on a fraction (T — 2) / T of the position, and so on. The 1-day position VaR adjusted 
by the square root of time is estimated for a given position as: 


VaRjxVT 


However, this formula overstates VaR for positions that are liquidated over time because it 
assumes that the whole position is held for T days. To adjust for the fact that the position 
could be liquidated over a period of days, the following formula can be used: 


VaR,x 


(1 + T)(1+2T) 


6T 


For example, if the position can be liquidated in four trading days (T = 4), the adjustment 
to the overnight VaR of the position is 1.3693, which means we should increase VaR by 
37%. This is greater than the initial 1-day VaR, but less than the 1-day VaR adjusted by the 
square root of T. 


Measuring Market Liquidity 

Factors such as tightness, depth, and resiliency are characteristics used to measure market 

liquidity. 

• Tightness (or width) refers to the cost of a round-trip transaction, measured by the 
bid-ask spread and brokers’ commissions. The narrower the spread, the tighter it is. The 
tighter it is, the greater the liquidity. 

• Depth describes how large an order must be to move the price adversely. In other words, 
can the market absorb the sale? The market can likely absorb a sale by an individual 
investor without an adverse price impact. However, if a large institution sells, it will 
likely adversely impact the price. 

• Resiliency refers to the length of time it takes lumpy orders to move the market away 
from the equilibrium price. In other words, what is the ability of the market to bounce 
back from temporary incorrect prices? 

Both depth and resiliency affect how quickly a market participant can execute a transaction. 
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Funding Liquidity Risk Management 

Redemption requests, especially in times of market stress, may require hedge fund managers 
to unwind positions rapidly, exposing the fund to transactions liquidity risk. If this happens 
to many funds at once, fire sales may result. Hedge funds manage liquidity via: 

• Cash. Cash can be held in money market accounts or Treasury bills and unencumbered 
liquidity. Cash is not wholly without risk, however, because money market funds may 
suspend redemptions in times of stress or crisis, and broker balances are at risk if the 
broker fails. 

• Unpledged assets. Unpledged assets, also called assets in the box, are assets not currently 
being used as collateral. They are often held with a broker. Price volatility of the assets 
affects their liquidity. Only Treasury securities, and more specifically Treasury bills, may 
be used as collateral during a financial crisis. Even government agency securities were not 
sufficient collateral during the 2007—2009 financial crisis. Unpledged assets can be sold, 
rather than pledged, to generate liquidity. However, in times of market stress, asset prices 
are often significantly depressed. 

• Unused borrowing capacity. This is not an unfettered source of liquidity as unused 
borrowing capacity can be revoked by counterparties by raising haircuts or declining to 
accept pledged assets as collateral when it is time to rollover the loan. These loans are 
typically very short term and credit can, as it did during the 2007-2009 financial crisis, 
disappear quickly. 

During the crisis, a systemic risk event, hedge funds that had not experienced large losses 
still faced a liquidity crisis as investors, seeking liquidity themselves, issued redemption 
requests. 
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Key Concepts 


L0 54.1 

Liquidity has two essential properties, which relate to two essential forms of risk. 
Transactions liquidity deals with financial assets and financial markets and is related to the 
ability to sell an asset quickly, cheaply, and without moving the price too much. Funding 
liquidity is related to individuals or firms creditworthiness. 


LO 54.2 

Banks only expect a fraction of deposits and other liabilities to be redeemed at any point in 
time. As a result, they do not hold all deposits in liquid assets, but make loans with deposits 
instead. This is known as a fractional-reserve bank and the process of using deposits to 
finance loans is known as asset-liability management (ALM). 


LO 54.3 

Systematic funding risks were apparent in many market sectors during the subprime 
mortgage crisis. Liquidity issues arose during the recent financial crisis for a variety of 
investment strategies. 

Money market mutual funds (MMMFs) have net assets (NAVs) equal to $1.00. However, 
credit write-downs can result in net asset values falling below $1.00. This is known as 
breaking the buck. Liquidity risk can also cause NAVs to fall below $1.00. 


LO 54.4 

Collateral markets enhance the ability of firms to borrow money. They also make it possible 
to establish short positions in securities. Cash and securities may be borrowed in the market 
for collateral. 

Firms with excess cash are more willing to lend at a low rate of interest if the loan is secured 
by collateral. The full value of the securities is not lent. The difference is called a haircut. 

Collateralized loans are used to finance securities or other assets or trades. The securities 
pledged to one firm are often loaned or pledged again, hence the collateral circulates. This 
process is known as rehypothecation or repledging. 
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LO 54.5 

A firm’s leverage ratio is equal to its assets divided by equity. That is: 


L 


A 

E 


(E + D) 

E 



Return on equity (ROE) is higher as leverage increases, as long as the firms return on assets 
(ROA) exceeds the cost of borrowing funds. This is called the leverage effect. The leverage 
effect can be expressed as: 




LO 54.6 

There is embedded leverage in short positions and derivatives such as options and swaps. 
Economic balance sheets can be constructed to help investors and/or firms measure the 
implicit leverage of these transactions. 


LO 54.7 

Transactions liquidity implies that an asset can be bought or sold without moving its 
price. Transactions liquidity risk is fundamentally related to the costs of searching for a 
counterparty, the institutions required to assist in that search, and the costs of inducing a 
counterparty to hold a position. 

To understand transactions liquidity risk, one must understand market microstructure 
fundamentals. Trade processing costs, inventory management, adverse selection (i.e., dealing 
with informed versus uninformed traders), and differences of opinions regarding asset prices 
affect transactions liquidity. 

Factors such as tightness, depth, and resiliency are characteristics used to measure market 
liquidity. Tightness (or width) refers to the cost of a round-trip transaction, measured by 
the bid-ask spread and brokers’ commissions. Depth describes how large an order must be 
to move the price adversely. Resiliency refers to the length of time it takes lumpy orders to 
move the market away from the equilibrium price. 

Hedge funds manage liquidity via cash, unpledged assets, and unused borrowing capacity. 

In times of market stress, redemption requests may require hedge fund managers to unwind 
positions rapidly, exposing the fund to transactions liquidity risk. If this happens to many 
funds at once, fire sales may result. 
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LO 54.8 

Assuming that daily changes in the bid-ask spread are normally distributed, the 99% 
confidence interval on the transactions cost in dollars is: 


+/- P X i/2(s + 2.33 ct^) 


The spread risk factor is equal to Vi(s + 2.33a^). 

Liquidity-adjusted VaR is a tool used to measure the risk of adverse price impact. Traders 
will often liquidate positions over a period of days in order to ensure an orderly liquidation 
of the position. 


LO 54.9 

Risks associated with liquidity are interrelated and can exacerbate problems. For example, 
an increase in funding liquidity risk can lead to an increase in transactions liquidity risk. 
Also, severe stress to the financial system from a liquidity risk event would impact market 
participants simultaneously, suggesting that the illiquidity or insolvency of one counterparty 
may impact other market participants. 
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Concept Checkers 


1. Jackson Grimes, a trader for Glenn Funds, works on the repurchase agreement 
(repo) desk at his firm. Markets have been highly volatile but Glenn Funds has a 
large capital base and is sound. Grimes reports to the CEO that in the last month, 
the firm Glenn Funds borrows from has been consistently increasing collateral 
requirements to roll over repos. From the perspective of Glenn Funds, this 
represents: 

A. systematic risk. 

B. transactions liquidity risk. 

C. balance sheet risk. 

D. maturity transformation risk. 

2. Chris Clayton, an analyst for a private equity fund, noticed that merger arbitrage 
strategies at several hedge funds experienced large losses in late 2007 to early 2008. 
These losses were likely due to: 

A. abandoned merger plans due to a lack of available financing. 

B. target prices falling precipitously due to stock market corrections. 

C. acquirers filing for bankruptcy as the subprime mortgage crisis unfolded. 

D. idiosyncratic risks surrounding the merger arbitrage strategy. 

3. With respect to the valuation of money market mutual fund (MMMF) assets, funds: 

A. are not required to mark-to-market the underlying assets daily. 

B. must reflect changes in the values of underlying assets that are the result of 
changes in credit risks but may ignore value changes that are the result of 
changes in interest rates. 

C. will set the notional values of each of the underlying assets equal to $1.00. 

D. are not allowed to invest in any asset with a rating below AAA because asset 
values must not fluctuate outside of a 10% range around the historical value in 
order to keep the notional value equal to $1.00. 

4. Charleston Funds intends to use leverage to increase the returns on a convertible 
arbitrage strategy. The return on assets (ROA) of the strategy is 8%. The fund has 
$1,000 invested in the strategy and will finance the investment with 75% borrowed 
funds. The cost of borrowing is 4%. The return on equity (ROE) is closest to: 

A. 4%. 

B. 32%. 

C. 20%. 

D. 12%. 

5. Brett Doninger recently placed an order to sell a stock when the market price was 
$42.12. The market was volatile and, by the time Doninger s broker sold the stock, 
the price had fallen to $41.88. In the market, this phenomenon is known as: 

A. adverse selection. 

B. transactional imbalance. 

C. slippage. 

D. the spread risk factor. 
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Concept Checker Answers 


1. C Funding liquidity risk or balance sheet risk results when a borrower s credit position is either 

deteriorating or is perceived by market participants to be deteriorating. It also occurs when 
the market as a whole deteriorates. Under these conditions, creditors may withdraw credit 
or change the terms of credit. In this case, the lender is increasing the haircut and is thus 
changing the terms of credit. Glenn Funds creditworthiness does not actually have to decline 
for a lender to withdraw credit or change the terms of credit. 

2. A Systematic funding risks were apparent in many market sectors during the subprime 

mortgage crisis. Hedge funds engaged in merger arbitrage experienced losses in the early 
stages of the subprime mortgage crisis. After a merger is announced, the target’s stock 
price typically increases and the acquirer’s price sometimes declines due to increased debt. 
The merger arbitrage strategy exploits the difference between the current and announced 
acquisition prices. Hedge funds experienced large losses as mergers were abandoned when 
financing dried up. 

3. A MMMFs use a form of accounting called the amortized cost method, under the Securities 

and Exchange Commission’s (SEC) Rule 2a - 7. This means that MMMF assets do not have 
to be marked-to-market each day, as required for other types of mutual funds. However, the 
values of the underlying assets in the fund, despite their relative safety, are subject to change. 
As such, redemptions may be limited if asset values fall. 

4. C debt = $ 1 ,000 X 0.75 = $750 

leverage ratio = total assets / equity 
leverage ratio = $1,000 / $250 = 4 

where: 

r^ = return on assets 
r^ = return on equity 
= cost of debt 
L = leverage ratio 

return on equity = 4(8%) - [(4 - 1)(4%)] = 32% - 12% = 20% 

5. C Liquidity risks are introduced when bid-ask spreads fluctuate, when the trader’s own actions 

impact the equilibrium price of the asset (called adverse price impact), and when the price of 
an asset deteriorates in the time it takes a trade to get done. When the price deteriorates in 
the time it takes to get a trade done, it is called slippage. 
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Exam Focus 

Understanding the key failure mechanics for dealer banks is crucial for mitigating liquidity 
and solvency risks. Liquidity risks are accelerated when counterparties or prime broker clients 
question the solvency of a large dealer bank and, in turn, limit their exposure. This results 
in increased liquidity risk and insolvency risk for the bank and increased systemic liquidity 
risk for the financial markets in which dealer banks play commingled roles. Dealer banks 
play key roles as prime brokers, securities underwriters, special purpose entities (SPE), and as 
counterparties in the over-the-counter (OTC) derivatives and repo markets. Diseconomies 
of scope in risk management and corporate governance were revealed by the recent market 
crisis. Thus, new policies to alleviate dealer bank risks were implemented to address off- 
balance sheet risks, capital requirements, leverage, liquidity risks, clearing banks, and adverse 
selection effects in “toxic” asset markets. 


Functions of Dealer Banks 


LO 55.1: Describe the major lines of business in which dealer banks operate and 
the risk factors they face in each line of business. 


Large dealer banks provide a variety of intermediary functions in the markets for over-the- 
counter (OTC) derivatives, repurchase agreements, and securities. In addition, large dealer 
banks act as a prime broker for hedge funds and provide asset management for wealthy 
individuals and institutions. 

Large dealer banks play an important function in the OTC derivatives market. Dealer 
banks transfer the risk of the derivatives positions requested by counterparties by creating 
new derivatives contracts with other counterparties. Examples of types of OTC derivatives 
are interest rate swaps, collateralized debt obligations (CDOs), collateralized mortgage 
obligations (CMOs), and credit default swaps (CDSs). 

Counterparty risk in the OTC market refers to the risk that one or more of the 
counterparties will default on their contractual obligations. The total amount of wealth 
does not change as derivatives transfer wealth from one counterparty to another as 
contingencies are realized over time. However, if a counterparty incurs large losses, their 
derivatives contracts incur frictional bankruptcy costs that result in distress costs for their 
counterparties. Dealer banks are often counterparties to other dealer banks and large market 
players. Therefore, the solvency and liquidity problems of one large dealer bank can quickly 
result in increased systemic risk and a potential liquidity crisis. 
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If the dealer bank does not have the liquidity to function, they will become insolvent. The 
failure of a large dealer bank would result in increased systemic risk for the OTC market. 
When counterparties question the solvency of a dealer bank, they will take actions to reduce 
their exposure and exit their positions. For example, the default of Lehman Brothers in 
September of 2008 not only disrupted the OTC derivatives markets, but the repercussions 
were also felt by other financial markets and institutions. 

Another important function of large dealer banks is in the short-term repurchase or repo 
market. Large dealer banks finance significant fractions of another dealer banks assets 
through repos. Prior to the recent crisis, dealer banks used overnight repos to finance 
holdings of agency securities, corporate bonds. Treasuries, mortgages, and collateralized debt 
obligations (CDOs) with little incremental capital. Some large dealer banks had very high 
leverage due to the lack of capital requirements for these repos. The high leverage caused 
significant solvency risk when the use of subprime mortgages as collateral was questioned. 

The systemic and firm specific risk is significantly increased if a repo counterparty questions 
the solvency of a dealer bank. Counterparties are unlikely to renew repos, and the repo 
creditors may be legally required to sell collateral immediately. Without a government or 
central bank stepping in as a lender of last resort, dealer banks have no place to turn when 
repos are not renewed. As many dealer banks act as counterparties for other positions, the 
solvency of one dealer bank is likely to have a ripple effect and greatly increase the systemic 
risk of these markets. 

Dealer banks provide investment banking functions through the management and 
underwriting of securities issuances. These investment banking functions also include 
advising corporations regarding mergers and acquisitions and merchant banking functions, 
such as the buying and selling of oil, metals, and other commodities. These functions 
provide an important source of revenue for dealer banks. An additional strain on liquidity is 
caused by the lack of cash inflows when issuers question the solvency of the dealer bank and 
take their business elsewhere. This can lead to systemic risk as new issues and the liquidity 
of existing issues are halted, as few institutions are able or willing to fill the void when a 
large dealer banks solvency or liquidity are questioned. 

Large dealer banks act as a prime broker to large investors such as hedge funds. In this 
context, the services provided by the dealer banks include custody of securities, clearing, 
securities lending, cash management, and reporting. When the solvency of a prime broker is 
questionable, a hedge fund could demand cash margin loans from the dealer that are backed 
by securities. The prime broker may not be able to use those same securities as collateral 
with other lenders who may also question their solvency. Thus, the dealer banks liquidity 
position is weakened if large clients reduce their exposure by exiting their positions or 
entering new positions to offset their risk. 

In addition, if prime broker clients leave, then their cash and securities are no longer in the 
pool of funds to meet the dealer banks liquidity needs for other clients. A systemic shortage 
of collateral and a liquidity crisis can result from the reduction of collateral securities caused 
by the flight of prime brokerage clients. Systemic risk is even greater when hedge funds do 
not mitigate their exposure through diversification. Prior to the recent financial crisis, hedge 
funds had significant positions with only a few dealer banks. 
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Dealer banks also provide an important function as a counterparty for derivatives for 
brokerage clients. Dealer banks sometimes operate “internal hedge funds” and private equity 
partnerships. Off-balance sheet entity functions such as internal hedge funds, structured 
investment vehicles, and money market funds can have substantial losses. The dealer banks 
have an incentive to voluntarily support these entities to protect their reputation and 
franchise value. When a dealer bank shows signs of distress, counterparties and others may 
begin to exit their relationships, which severely increases the dealer banks liquidity risk. 

In addition, large dealer banks provide traditional commercial banking functions, such 
as gathering deposits for corporate and consumer lending. The risks for a dealer bank are 
similar to a traditional bank with respect to these functions. However, prior to the recent 
financial crisis, dealer banks did not have access to the discount window (borrowing money 
from the central bank), and their accounts were not federally insured. For these reasons, 
a run on the banks deposits was more likely to lead to a liquidity crisis. With increased 
concerns of the solvency of large dealer banks, the availability of credit across the industry 
was threatened. This had the potential to lead to severe market slowdowns if borrowers were 
unable to obtain credit. 


Dealer Bank Markets 

Large dealer banks operate in markets that are outside the scope of traditional bank-failure 
resolution mechanisms, such as conservatorship or receivership. The dealer banks are 
organized under the umbrella of holding companies in order to provide the wide variety of 
commercial banking, merchant banking, investment banking, brokerage, and off-balance 
sheet partnership activities. In addition, dealer banks often have large asset-management 
divisions that provide custody of securities, cash management, brokerage, and alternative 
investments vehicles. Dealer banks are also typically the general partner with limited partner 
clients. 

In the primary securities market, dealer banks are the security underwriter. They buy equity 
and bond securities from issuers and sell them to institutions and investors over a period of 
time. Dealer banks also play a major role in the secondary securities market in providing 
liquidity to the market. They are the primary intermediary in the OTC securities markets 
by assisting in the private negotiation between investors and corporations, municipalities, 
certain national governments, and securitized credit products. Dealer banks are also actively 
involved in publicly traded equity markets by acting as brokers, custodians, securities 
lenders, and facilitating large block trades. 

A major market in which dealer banks operate is the repurchase agreements, or repos, 
market. Repos are short-term cash loans collateralized by securities. In the repo market, one 
counterparty borrows cash from another counterparty. The majority of repos are for a very 
short period of time, such as overnight. The loans are collateralized by government bonds, 
corporate bonds, mortgages, agency securities, or other securities such as CDOs. In order to 
reduce counterparty risk, a clearing bank often acts as a third party and holds the collateral. 
The clearing bank facilitates the trade and somewhat reduces the risk of default for the 
lender. It is common for counterparties to renew these positions on a continuous basis as 
long as the solvency of the dealer bank is not questioned. It is not uncommon for these 
counterparties to be another dealer bank. 
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Dealer banks are usually counterparties in the OTC derivatives market. The most 
prominent OTC derivatives are interest rate swaps where variable rate commitments often 
linked to the London Interbank Offering Rate (LIBOR) are exchanged for a fixed rate 
for a specific time period. Dealer banks typically perform what is known as a “matched 
book” dealer operation. They transfer the risk of the derivatives positions requested by 
counterparties by creating new derivatives contracts with other counterparties, who are 
oftentimes other dealer banks. Thus, dealer banks have large OTC derivatives exposures 
with other dealer banks. In addition to dealing with interest rate swaps, dealers are often 
counterparties in CDSs. In these contracts, the dealer bank transfers the default risk rather 
than the interest rate risk for the counterparties involved in the contracts. 

Some large dealer banks are very active in off-balance sheet financing. In these markets, a 
bank can sell residential mortgages or other loans to a special purpose entity (SPE). The 
SPE compensates the sponsoring bank for the assets with the proceeds of debt that it issues 
to third-party investors or hedge funds. The SPE pays for the principal and interest of the 
debt issued with the cash flows from the mortgages or other assets that were purchased from 
the sponsoring bank. Thus, the SPE holds the collateralized pool of assets and provides 
an innovative product for hedge funds and other investors to purchase. These SPEs also 
provide a means for financial institutions to diversify their exposure by transferring risk to 
other investors who are either in or outside the financial industry. 

For example, prior to the recent financial crisis, dealer banks were actively participating 
as sponsor banks for structured investment vehicles (SIVs), which are a form of a special 
purpose entity. The SIV finances residential mortgages or other debt obligations with short¬ 
term debt sold to other investors in the form of CDOs and CMOs. 

Before the recent crisis, banks were not required to include the off-balance sheet assets and 
debt obligations in minimum capital requirement and accounting reports. Thus, some 
dealer banks became highly leveraged as they were allowed to operate much larger loan 
purchases and origination businesses with a limited amount of capital. The fall in residential 
housing values in the summer of 2007 led to the rise of mortgage defaults, which threatened 
the ability of the SIV to make payments. As short-term creditors became concerned 
with the solvency of the SIVs, they refused to renew loans, and this created a liquidity 
and solvency issue for SIVs. Dealer banks had to provide support to SIVs to protect its 
reputation and franchise value. 

Diseconomies of Scope 

As mentioned, dealer banks act as holding companies in order to provide a wide variety 
of commercial banking, prime brokerage, investment banking, asset management, and 
off-balance sheet activities. The recent financial crisis caused many to question the ability 
of dealer banks to manage risks properly. It is sometimes argued that forming large bank 
holding companies results in economies of scope with respect to information technology, 
marketing, and financial innovation. However, the recent financial crisis clearly identified 
diseconomies of scope in risk management and corporate governance. The executive 
management and board of directors did not fully understand or control the risk taking 
activities within their organizations. 

For example, prior to their insolvency. Bear Stearns and Lehman relied heavily on overnight 
repos with leverage ratios above 30. These dealer banks held these assets on their balance 
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sheets with little incremental capital. Management did not properly manage the amount of 
off-balance sheet risk the bank was exposed to. Thus, the over-leveraged positions made it 
impossible to overcome the liquidity and solvency issues that quickly arose when the values 
of the banks assets were questioned. Increased awareness or more appropriate risk models 
may have prevented the insolvency of these dealer banks. 

Liquidity Concerns for Dealer Banks 


LO 55.2: Identify situations that can cause a liquidity crisis at a dealer bank and 
explain responses that can mitigate these risks. 


A liquidity crisis for a dealer bank is accelerated if counterparties try to reduce their 
exposure by restructuring existing OTC derivatives with the dealer or by requesting a 
novation (as discussed in the following). The flight of repo creditors and prime brokerage 
clients can also accelerate a liquidity crisis. Lastly, the loss of cash settlement privileges is the 
final collapse of a dealer banks liquidity. 

As mentioned previously, when OTC derivatives counterparties question the solvency of a 
dealer bank, they will begin to reduce their exposures to the dealer. A counterparty could 
reduce their exposure by borrowing from the dealer or by entering into new offsetting 
derivatives contracts with the dealer. A counterparty may also request to have in-the-money 
options revised to at-the-money strike prices and, thus, reduce their exposure to the dealer 
by receiving cash from the option position. 

Another means that a counterparty has of reducing their exposure to a dealer is through a 
novation to another dealer. For example, a hedge fund may use a credit default swap from 
a dealer to protect themselves from a loss on a borrower. If the hedge fund was concerned 
about the solvency of the dealer bank, they could request a novation from another dealer 
bank to protect themselves from default arising from the original dealer bank. Although 
these novations are often granted by dealer banks, in the case of Bear Stearns, the request 
was denied, which raised additional concerns regarding the solvency of Bear Stearns. In 
addition to decreasing the reputation capital and franchise value of this dealer bank, the 
liquidity position was also under increased stress. A novation could result in the removal 
of the cash collateral of the original dealer bank and transfer of this collateral to the second 
dealer bank. 

Central clearing mitigates the liquidity risk caused by derivatives counterparties exiting 
their large dealer bank exposures. OTC derivatives are novated or “cleared” to a central 
clearing counterparty that stands between the original counterparties. The use of a central 
clearing counterparty also mitigates the systemic risk of financial markets and institutions 
when the solvency of a large dealer bank is questioned. However, the use of central clearing 
counterparties is only effective with derivatives that contain relatively standard terms. 

Thus, this was not an effective means of dealing with the infamous customized AIG credit 
derivatives. 

Further liquidity pressure can arise if derivative counterparties desire to reduce their 
exposure by entering new contracts that require the dealer bank to pay out cash. For 
example, a dealer bank may try to signal their strength to the market by quoting 
competitive bid-ask spreads on an OTC option. If the bid price is then accepted, the dealer 
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must settle with a cash payment to the counterparty which reduces their liquidity. If the 
dealer refuses to quote competitive bid prices, it may further signal their liquidity concerns 
to the market. 

Money market funds, securities lenders, and other dealer banks finance significant 
fractions of a dealer banks assets through short-term repurchase agreements. As mentioned 
previously, if the repo counterparty questions the solvency of a dealer bank, they are 
unlikely to renew repos. In this event, the repo creditors may have an incentive, or be 
legally required, to sell the collateral immediately. If the sale of the collateral is less than the 
cash position, then the dealer counterparty may face litigation for the improper disposal of 
assets. Without a government or central bank stepping in as a lender of last resort, dealer 
banks have no place to turn when repos are not renewed. They could reinvest their cash in 
new repos, but other counterparties are unlikely to take these positions if the dealer banks 
solvency is questioned. 

The dealer bank can mitigate the liquidity risk caused by a run of short-term creditors 
by establishing lines of bank credit, holding cash and liquid securities, and by laddering 
the maturities of its liabilities. When a dealer bank ladders its liabilities, the maturities 
are spread out over time so that only a small fraction of its debt needs to be refinanced 
overnight. In 2008, the New York Federal Reserve Bank created the Primary Dealer Credit 
Facility to finance securities of investment banks. Immediately following the failure of 
Lehman, the remaining two dealer banks, Morgan Stanley and Goldman Sachs, became 
regulated bank holding companies. As a bank holding company, the firms gained access to 
the discount window and could turn to the government for financial support, including 
FDIC deposit insurance and loan guarantees. 

Prime brokerage accounts are a source of cash inflows for large dealer banks. In normal 
circumstances, the cash and securities of prime brokerage clients are a source of liquidity 
for the bank. In the United Kingdom, assets from client prime brokerage accounts are 
commingled with the banks own assets. However, in the United States, dealer banks are 
allowed to pool the money together into a separate account from the banks own funds. 
Thus, the prime broker is able to use the cash from one client to help meet the liquidity 
needs of another client. 

As mentioned previously, when the solvency of a prime broker is questionable, a hedge fund 
could demand cash margin loans from the dealer that are backed by the securities held in 
their account with the prime broker. The prime broker may not be able to use those same 
securities as collateral with other lenders who may question their solvency. Lenders may 
not find any incentive to lend to the questionable dealer bank. Thus, even without a run by 
prime brokerage accounts, considerable strain could be placed on the dealer banks liquidity 
position. 

In addition, if prime broker clients do leave on short notice, then their cash and securities 
are no longer in the pool of funds to meet the needs of other clients. In this case, the dealer 
bank must use its own cash to meet liquidity needs. The reduction of collateral securities 
caused by the flight of prime brokerage clients can lead to a systemic shortage of collateral 
and a liquidity crisis. In the future, hedge funds are likely to mitigate their exposure to a few 
dealer banks by diversifying their sources of prime brokerage with custodian banks. 
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Under normal conditions, a clearing bank may extend daylight overdraft privileges to 
clearing customers who are creditworthy. However, when the solvency of a dealer bank 
is questioned, the clearing bank may refuse to process transactions that are insufficiently 
funded by the dealer banks cash fund account. For example, in the case of Lehmans default, 
J.P. Morgan Chase was the clearing bank that invoked its “full right of offset.” Under this 
legal right, J.P. Morgan Chase was able to offset their exposures using Lehmans cash, and at 
the same time, discontinued to make cash payments during the day on Lehman transactions 
that would bring Lehmans account below zero. The failure to meet its transactions 
obligations on that day forced Lehman into bankruptcy. To mitigate this risk in the future, 
“emergency banks” are proposed to act as either a clearing bank or a tri-party repo “utility.” 

The basic economic principles causing a liquidity crisis, and potentially the insolvency 
of a large dealer bank, are not that different from the traditional retail bank run. Banks 
may finance illiquid assets with short-term deposits. However, an unexpected liquidity 
demand from depositors or the inability of borrowers to repay their loans may lead to 
concerns about the solvency of the bank. If the concern persists, a bank run could lead to 
liquidity problems, and the concern about the banks failure could end up as a self-fulfilling 
prophecy. 

While the basic economic principles of a bank run are similar for large dealer banks 
and retail banks, the institutional mechanisms and the systemic destructiveness are very 
different. For example, dealer banks play an essential role in providing liquidity in the 
OTC derivatives and securities markets. When the solvency of a dealer bank is questioned, 
counterparties of these markets and prime brokerage clients begin to reduce their exposure 
to the dealer. The OTC derivatives counterparty may reduce their exposure by borrowing 
from the dealer, entering new offsetting derivatives contracts with the dealer, or requesting 
a novation. A counterparty may also request to receive cash from options positions that are 
in-the-money by having them revised to at-the-money. Prime broker clients may remove 
collateral and cash, which results in further accelerating the liquidity crisis. The fact that 
dealer banks are often counterparties to other dealer banks increases the systemic risk in the 
financial markets where dealer banks play essential roles. 

Another area that dealer banks are very active involving liquidity is the repo markets. 
Especially in cases where the dealer banks are highly leveraged, the liquidity position 
is severely threatened when the dealer banks solvency is questioned and counterparties 
are unwilling to renew repo positions overnight. Thus, a dealer bank is involved in 
many functions that result in increased liquidity pressures that traditional banks are not 
exposed to. 
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Polices to Alleviate Dealer Bank Risks 


LO 55.3: Describe policy measures that can alleviate firm-specific and systemic 
risks related to large dealer banks. 


The 2009 Public Private Investment Partnership (PPIP) was instituted by the U.S. Treasury 
Departments 2008 Troubled Asset Relief Program (TARP) to help dealer banks and 
the financial industry recover from the crisis at hand. One of the policy objectives was to 
mitigate the effect of adverse selection in the market for “toxic” assets, such as the CD Os 
backed by subprime mortgages. Adverse selection is the principle that buyers are only 
willing to buy the assets at a deep discount due to the information asymmetries that exist 
regarding the asset s true value. A dealer bank may be forced to sell illiquid assets in order 
to meet liquidity needs. This results in additional losses due to the lack of demand for those 
assets. The PPIP subsidizes bidders of “toxic assets” by offering below-market financing rates 
and absorbing losses beyond a predetermined level. 

The United States Federal Reserve System and the Bank of England provided new secured 
lending facilities to large dealer banks when they were no longer able to obtain credit 
from traditional counterparties or the repo market. When the dealer banks solvency is 
questioned, tri-party clearing banks are likely to limit their exposure to the dealer bank. 

A tri-party repo utility is proposed as an alternative and would be designed to have fewer 
conflicting incentives and less discretion in rolling over a dealer s repo positions. New 
standards could be adapted for transaction documentation, margin requirements, and 
daily substitution of collateral with respect to repos. These standards could be incorporated 
through either the new repo utility or traditional tri-party clearing approaches. 

Another potential approach is the creation of an “emergency bank” that could manage the 
orderly unwinds of repo positions of dealer banks with liquidity difficulties. The central 
bank would grant access to the discount window for the emergency bank to insulate critical 
clearing banks from losses during this unwinding process. 

Capital requirements will most likely be increased and include oflF-balance sheet positions 
in an effort to reduce the leverage positions of dealer banks. The separation of tri-party repo 
clearing from other clearing account functions would also reduce a dealer banks leverage by 
tightening the dealer s cash-management flexibility. 

Central clearing will reduce the threat of OTC derivatives counterparties fleeing a 
questionable dealer bank. Although this would not eliminate the liquidity effect resulting 
from a derivative counterparty reducing their exposure to a particular dealer bank, it would 
reduce the total exposure to the dealer that would need to be managed through clearing. 

Some large dealer banks and financial institutions are viewed as being “too-big-to- 
fail” based on the systemic risk their insolvency would place on the financial markets. 
Therefore, another proposed resolution for large dealer banks with questionable solvency 
that are deemed too-big-to-fail is to provide bridge banks similar to the approach used for 
traditional banks. 
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Key Concepts 


LO 55.1 

Large dealer banks are active participants in over-the-counter (OTC) derivatives, repo, 
and securities markets. Their functions in these markets, as well as asset managers and 
prime brokers, result in a variety of liquidity risks when their solvency is questioned and 
counterparties reduce their exposure with them. 


LO 55.2 

A liquidity crisis is accelerated when prime broker clients or counterparties in the OTC 
derivatives or repo markets question the solvency of a dealer bank and desire to exit their 
positions or reduce their exposures with the dealer bank. 


LO 55.3 

The creation of emergency banks in the form of tri-party repo utilities and clearing banks 
are policy proposals to mitigate firm specific and systemic liquidity risk in the OTC 
derivatives and repo markets. The U.S. Treasury Department s 2008 Troubled Asset Relief 
Program (TARP) was designed to mitigate adverse selection in “toxic” asset markets by 
providing below market financing and absorbing losses above a pre-specified amount. 
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Concept Checkers 


1. A dealer banks liquidity crisis is least likely to be accelerated by: 

A. the refusal of repurchase agreement creditors to renew their positions. 

B. the flight of prime brokerage clients. 

C. a counterparty’s request for a novation through another dealer bank. 

D. depositors removing their savings from the dealer bank. 

2. Banks are most likely to diversify their exposure to a specific asset class such as 
mortgages by grouping these assets together and selling them to: 

A. hedge funds. 

B. government agencies. 

C. the U.S. Federal Reserve. 

D. special purpose entities. 

3. The formation of large bank holding companies results in diseconomies of scope 
with respect to: 

A. risk management. 

B. technology. 

C. marketing. 

D. financial innovation. 

4. One potential solution for mitigating the liquidity risk caused by derivatives 
counterparties exiting their large dealer bank exposures is most likely the: 

A. use of central clearing. 

B. use of a novation through another dealer bank. 

C. requirement of dealer banks to pay out cash to reduce counterparty exposure. 

D. creation of new contracts by counterparties. 

5. Which of the following items is not a policy objective of the U.S. Treasury 
Department’s 2008 Troubled Asset Relief Program to help dealer banks recover from 
the subprime market crisis? 

A. Provide below-market financing rates for bidders of “toxic” assets. 

B. Absorb losses beyond a pre-specified level. 

C. Force the sale of illiquid assets in order to better determine the “true” value. 

D. Mitigate the effect of adverse selection. 
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Concept Checker Answers 


1. D A liquidity crisis for a dealer bank is accelerated if counterparties try to reduce their exposure 

by restructuring existing OTC derivatives v^ith the dealer or by requesting a novation. The 
flight of repo creditors and prime brokerage clients can also accelerate a liquidity crisis. 

Lastly, the loss of cash settlement privileges is the final collapse of a dealer banks liquidity. 

2. D Banks can diversify their exposure to a specific asset class, such as mortgages, by grouping 

these assets together and selling them to special purpose entities. 

3. A Some argue that information technology, marketing, and financial innovation result in 

economies of scope for large bank holding companies. Conversely, the recent financial crisis 
raised the concern that the size of bank holding companies creates diseconomies of scope 
with respect to risk management. 

4. A One potential solution for mitigating the liquidity risk caused by derivatives counterparties 

exiting their large dealer bank exposures is the use of central clearing through a counterparty. 
However, central clearing is only effective when the underlying securities have standardized 
terms. The reduction of a counterparty’s exposure through novation, entering new offsetting 
contracts, or requiring a dealer bank to cash out of a position will all reduce the liquidity of 
the dealer bank. 

5. C The U.S. Treasury Department’s 2008 Troubled Asset Relief Program was designed to create 

policies to help dealer banks recover from the subprime market crisis by mitigating the effect 
of adverse selection, by providing below-market financing rates for bidders of “toxic” assets, 
and by absorbing losses beyond a pre-specified level. Forcing the sale of illiquid assets would 
worsen the liquidity position of the troubled dealer bank. 
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Stress Testing Banks 


Topic 56 

Exam Focus 

This topic focuses on the use of bank stress testing to determine if liquidity and capital are 
adequate. The discussion focuses primarily on capital adequacy but notes that the issues 
are similar with respect to liquidity. For the exam, understand the details of the 2009 
Supervisory Capital Assessment Program (SCAP), the first stress testing required after the 
2007—2009 financial crisis. Also, be able to explain the issue of coherence in stress testing 
and describe the challenges with modeling the balance sheet using stress tests in the context 
of the stress test horizon. Finally, understand the differences in disclosure between U.S. and 
European stress tests and the way that stress test methodologies and disclosure have changed 
since the 2009 SCAP. 


Stress Testing 

In the wake of the 2007—2009 financial crisis, regulators and other policymakers realized 
that standard approaches to risk assessment, such as regulatory capital ratio requirements, 
were not sufficient. At that point, supervisory stress testing became a popular tool for 
measuring bank risk. There was a “pop-quiz” quality to the post-financial crisis stress tests. 
They were difficult to manipulate because they were sprung on banks at short notice. As a 
result, the information provided by the stress tests to regulators and the market was truly 
new. This allowed financial markets to better understand bank risks and, as a result, regain a 
level of trust in the banking sector. 

The goal of stress testing, as well as capital/liquidity and “economic capital/liquidity” 

(i.e., internal, bank-specific) models, is to assess how much capital and liquidity a financial 
institution needs to support its business (i.e., risk taking) activities. It is relatively easy for 
banks to swap out of lower risk assets and into higher risk assets. Stress testing provides 
clarity about the true risk and soundness of banks. 

Stress testing is an old tool that banks and other firms have used to examine risk. It asks 
the question “what is the institutions resilience to deteriorating conditions?” and simulates 
financial results given various adverse scenarios. Stresses are generally of two basic types: 
scenarios or sensitivities. An example of a scenario is a severe recession. An example 
of sensitivity is a significant increase in interest rates. Risk managers can stress test the 
sensitivity of a single position or loan or an entire portfolio. 
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Supervisory Capital Assessment Program (SCAP) 


LO 56.1: Describe the historical evolution of the stress testing process and compare 
methodologies of historical EBA, CCAR and SCAP stress tests. 


In the wake of the financial crisis, there was much uncertainty about the soundness of 
the U.S. banking system. Regulators needed to assess the capital strength of financial 
institutions. If there was a gap between what a bank needed in terms of capital and what it 
had, regulators had to find a credible way to “fill the hole.” The 2009 U.S. bank stress test, 
known as the Supervisory Capital Assessment Program (SCAP), was meant to serve that 
purpose. It was the first macro-prudential stress test after the 2007—2009 financial crisis. 
Macro-prudential regulation focuses on the soundness of the banking system as a whole 
(i.e., focuses on systematic risks) while micro-prudential regulation focuses on the safety 
and soundness of the individual institution. 

At this point the Federal government planned to infuse equity capital into banks that 
were undercapitalized based on stress testing. The Treasury intended to borrow money 
and “downstream” it as equity in banks via the Treasury’s Capital Assistance Program 
(CAP). If banks could not convince investors to fill the hole (i.e., infuse banks with needed 
equity capital), current investors would be diluted by the governments equity investment. 
In the end, 19 SCAP banks were required to raise $75 billion within six months. The 
undercapitalized banks raised $77 billion of Tier 1 common equity and did not need to 
draw on the CAP funds. 

Prior to 2009, stress testing was relatively simple. Figure 1 summarizes the differences in 
stress testing pre-SCAP and post-SCAP. 


Figure 1: Comparison of Stress Testing Pre-SCAP and Post-SCAP 


Pre-SCAP 

Post-SCAP 

Primarily assessed exposure to single-shocks 
(e.g., volatility increases OR interest rate 
increases OR increasing unemployment). 

Considers broad macro-scenarios and market-wide 
stresses with multiple factors occurring/changing at 
once, as evidenced in the 2007-2009 financial crisis. 

Focused on specific bank products or 
business units (e.g., lending or trust). 

Focuses on the whole firm, a more comprehensive 
look at the effect of the stress scenarios on the 
institution. 

Typically focused on earnings shocks 
(i.e., losses) but not on capital adequacy. 

Explicitly focuses on capital adequacy. Considers the 
post-stress common equity threshold to ensure that 
a bank remains viable. 

Focused exclusively on losses. 

Focuses on revenues, costs, and projected losses. 

Stress testing was static in nature. 

Stress testing is now dynamic and path dependent. 


Professor's Note: We will compare and contrast SCAP, CCAR, and EBA stress 
tests later in this topic. 
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Challenges in Designing Stress Tests 


LO 56.2: Explain challenges in designing stress test scenarios, including the 
problem of coherence in modeling risk factors. 


One of the challenges of designing useful stress tests is coherence. The sensitivities and 
scenarios must be extreme but must also be reasonable or possible (i.e., coherent). Problems 
are inherently multi-factored, making it more difficult to design a coherent stress test. For 
example, an increase in volatility can lead to credit markets freezing. High unemployment 
and falling equity prices often go hand-in-hand. It is not sufficient to specify one potential 
problem (i.e., risk factor) because the others do not remain fixed. The supervisors key 
challenge is to specify the joint outcomes of all relevant risk factors. 

Additionally, not everything goes bad at once. For example, if some currencies are 
depreciating, others must be appreciating. If there is a “flight to quality,” there must also 
be safe haven assets in the stress model. So while it is important to look at, for example, 
what happens if U.S. Treasury debt becomes riskier and is no longer a safe haven, the model 
would at the same time have to identify the “risk-free” asset(s) in which capital would flee 
under those circumstances. 

The problem is even greater when designing stress scenarios for marked-to-market 
portfolios of traded securities and derivatives. Risk is generally managed with a value at risk 
(VaR) system. Hundreds of thousands of positions in the trading book must be mapped to 
thousands of risk factors, tracked on a daily basis. The data that results is used to estimate 
volatility and correlation parameters. It is very difficult to find coherent outcomes in such a 
complex, multi-dimensional universe. 

The 2009 SCAP tested rather simple scenarios with three variables: growth in GDP, 
unemployment, and the house price index (HPI). Historical experience was used for the 
market risk scenario (i.e., the financial crisis—a period of “flight to safety,” the failure of 
Lehman, and higher risk premia). While the market risk scenario did not test for something 
new, the overall framework achieved coherence of financial and other stresses of the time 
period. 

One thing to note is that prior to 2011 all supervisory stress tests imposed the same 
scenarios on all banks (i.e., a one-size-fits-all approach to stress testing). In recognition of 
the problem, the 2011 and 2012 Comprehensive Capital Analysis and Review (CCAR) 
asked banks to submit results from their own stress scenarios in addition to the supervisory 
stress scenario in an attempt to reveal bank-specific vulnerabilities. This was an important 
step forward from the 2009 SCAP as it gave supervisors a sense of what banks think are 
the high risk scenarios. This provides regulators with not only bank-specific (i.e., micro¬ 
prudential) insight but also improves macro-prudential supervision as it highlights common 
risks across banks that may have been underemphasized or unnoticed before. 
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LO 56.3: Explain challenges in modeling a banks revenues, losses, and its balance 
sheet over a stress test horizon period. 


Current stress tests are based on macro-scenarios (e.g., unemployment, GDP growth, the 
HPI). One concern is how to translate the macro-risk factors employed in stress testing 
into micro (i.e., bank-specific) outcomes related to revenues and losses. Supervisors need to 
map from macro-factors into intermediate risk factors that drive losses in specific products 
and geographic areas. Although not limited to these products, geographic differences are 
especially important in modeling losses in both commercial and residential real estate 
lending. 

Credit card losses are particularly sensitive to unemployment figures. For example, 
unemployment was 12.9% in Nevada in July 2011, 3.3% in North Dakota, and the 
national unemployment rate was 9.1%. Credit card loss rates varied dramatically from 
region to region during this period. The geographic diversity with respect to macro-factors 
makes a “one-size-fits-all” stress testing regime less meaningful. 

Geography is not the only difference supervisors must contend with. Risks affect different 
asset classes in different ways. For example, during recessions people buy fewer automobiles 
overall. However, if a person needs a car during a recession, he is more likely to buy a used 
car. Thus, if default rates increase, loss given default (LGD) (i.e., loss severity) may not 
increase as much. 

The business cycle also affects different industries at different times. Consider the airline 
industry versus the healthcare industry during a recession. Airplanes are collateral for loans 
to airlines. If the airline industry is depressed, the bank gets stuck with collateral that is very 
difficult to sell except at extremely depressed prices. Healthcare is somewhat recession-proof 
but that doesn’t mean the bank can transform an airplane it is stuck with into a hospital. 
These factors increase the difficulty of mapping broader macro-factors to bank-specific stress 
results. 

Modeling revenues over a stress test horizon period is much less developed than modeling 
losses. The 2009 SCAP did not offer much clarity on how to calculate revenue during times 
of market stress. The main approach to modeling revenue is to divide a banks total income 
into interest and non-interest income. The yield curve can be used to estimate interest 
income, and it can reflect credit spreads during stress testing scenarios; however, it remains 
unclear how bank profitability is directly influenced by the net impact of changing interest 
rates. Estimating noninterest income, which includes fees and service charges, is even more 
difficult to model. This is alarming given the steady increase in noninterest income among 
U.S. banks. 

Challenges in Modeling the Balance Sheet 

The typical stress test horizon is two years. Over this period, both the income statement 
and balance sheet must be modeled to determine if capital is adequate post-stress. Generally 
speaking, capital is measured as a ratio of capital to assets. There are different types of 
capital (e.g.. Tier 1 and Tier 2) but in general (and for the sake of simplicity), capital can be 
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defined as common equity. Risk-weighted assets (RWA) are computed based on the Basel II 
risk weight definitions. For example, agency securities have a lower risk weight than credit 
card loans. 

In a stress model, the beginning balance sheet generates the first quarters income and loss 
from the stressed scenario, which in turn determines the quarter-end balance sheet. At that 
point, the person modeling the risk must consider if any assets will be sold or originated, 
if capital is depleted due to other actions such as acquisitions or conserved as the result of 
a spin-off, if there are changes made to dividend payments, if shares will be repurchased or 
issued (e.g., employee stock or stock option programs), and so on. These decisions make 
modeling the balance sheet over the stress horizon quite difficult. The stress model doesn’t 
determine if it would be a good time to sell a subsidiary or lower dividend payments. 

The challenges of balance sheet modeling exist under both static and dynamic modeling 
assumptions. The bank must maintain its capital (and liquidity) ratios during all quarters of 
the stress test horizon. At the end of the stress horizon the bank must estimate the reserves 
needed to cover losses on loans and leases for the next year. This means that a two-year 
horizon stress test is actually a three year stress test (i.e., aT-year stress test requires the bank 
to estimate required reserves to cover losses forT+1 years). 

Stress Test Comparisons 

Disclosure was a significant feature of the 2009 SCAP. It disclosed projected losses for each 
of the 19 participating banks for eight asset classes. It also disclosed resources the bank 
had to absorb losses other than capital (e.g., pre-provision net revenue and reserve releases 
if available). This high level of disclosure created transparency. It allowed investors and 
the market to check the severity of stress tests and to comprehend stress test outcomes at 
the individual bank level. Before the 2009 SCAP, banks only reported realized losses, not 
forecasted losses (i.e., possible losses given the stress scenario). 

The 2011 CCAR required only that macro-scenario results be published, not bank level 
results. This differed dramatically from the 2009 SCAP requirements. The market had to 
figure out whether a bank had passed the test or not (i.e., market participants had to “do 
the math” themselves). For example, if a bank increased its dividend, it was assumed by the 
market to have “passed” the stress test. However, the 2012 CCAR disclosed virtually the 
same amount and detail of bank level stress data as the 2009 SCAP (i.e., bank level loss rates 
and losses by major asset classes). The regulatory asset classes are: 

1. First and second lien mortgages. 

2. Commercial and industrial (C&I) loans. 

3. Commercial real estate loans. 

4. Credit card lending. 

5. Other consumer loans. 

6. Other loans. 
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One of the key contributions of the CCAR was that in both 2011 and 2012 the CCAR 
required banks to submit the results of their own scenarios, both baseline and stress, not 
just supervisory stress test results. The Fed also reported dollar pre-provision net revenue 
(PPNR), gains and losses on available-for-sale and held-to-maturity securities, and trading 
and counterparty losses for the six institutions with the largest trading portfolios. These 
firms were required to conduct the trading book stress test. The numbers that were reported 
were supervisory estimates, not bank estimates, of losses under the stress scenario. 

In contrast, the 2011 European Banking Authority (EBA) Irish and 2011 EBA European¬ 
wide stress tests, both disclosed after the CCAR, contained considerable detail. In the Irish 
case, the report contained a comparison of bank and third party estimates of losses. The 
EBA data was available in electronic, downloadable form. Ireland needed credibility, having 
passed the Committee of European Bank Supervisors (CEBS) stress test in July 2010 only 
to need considerable aid four months later. In general, the faith in European supervisors was 
harmed and only by disclosing detailed information on bank-by-bank, asset-class, country, 
and maturity bucket basis could the market interpret the data and draw its own conclusions 
about individual bank risks. Figure 2 summarizes the differences among the various stress 
test regimes. 
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Figure 2: Comparison of Macro-prudential Stress Tests 


Stress Test 

Methodologies 

Disclosure 

Findings 

SCAP (2009). All 
banks with $ 100 
billion or more in 
assets as of 2008 
year end were 
included. 

Tested simple scenarios with 
three dimensions, GDP 
growth, unemployment, 
and the house price index 
(HPI). Historical experience 
was used for the market risk 
scenario (i.e., the financial 
crisis—a period of “flight 
to safety,” the failure of 
Lehman, and higher risk 
premia). A “one-size-fits-all” 
approach. 

First to provide 
bank level projected 
losses and asset/ 
product level loss 
rates. 

19 SCAP banks were 
required to raise 
$75 billion within 
six months. The 
undercapitalized 
banks actually raised 
$77 billion of Tier 1 
common equity and 
none of the banks 
were forced to use 
the Treasury’s Capital 
Assistance Program 
funds. 

CCAR(2011) 

In recognition of “one-size- 
fits-all” stress testing, CCAR 
asked banks to submit 
results from their own 
baseline and stress scenarios. 

Only macro¬ 
scenario results 
were published. 


CCAR(2012) 

Banks were again asked to 
submit their own baseline 
and stress test results. 

Similar in detail to 
SCAP 2009— bank 
level and asset/ 
product level loss 
rates disclosed. 


EBA Irish (2011) 

Similar in design to EBA 
Europe 2011. 

Comparison of 
bank and third 
party projected 
losses; comparison 
of exposures by 
asset class and 
geography. Data 
is electronic and 
downloadable. 

After passing the 

2010 stress tests, 2011 
stress tests revealed 

Irish banks needed 
€24 billion. Greater 
disclosure in 2011 
resulted in tightening 
credit spreads on 

Irish sovereign and 
individual bank debt. 

EBA Europe 
(2011). [formerly 
the Committee of 
European Bank 
Supervisors (CEBS)] 
90 European banks 
were stress tested. 

Specified eight macro-factors 
(GDP growth, inflation, 
unemployment, commercial 
and residential real estate 
price indices, short and 
long-term government rates, 
and stock prices) for each 
of 21 countries. Specified 
over 70 risk factors for 
the trading book. It also 
imposed sovereign haircuts 
across seven maturity 
buckets. 

Bank level 
projected losses. 
Comparisons of 
exposures by asset 
class and geography. 
Data is electronic 
and downloadable. 

Eight banks were 
required to raise €2.5 
billion. 
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The key benefit of greater disclosure is transparency. Transparency is especially important 
in times of financial distress. However, during “normal” times, the costs of disclosure may 
outweigh the benefits. For example, banks may “window dress” portfolios, making poor 
long-term investment decisions to increase the likelihood of passing the test. Traders may 
place too much weight on the public information included in stress test disclosure and be 
disincentivized to produce private information about financial institutions. This harms 
the information content of market prices and makes prices less useful to regulators making 
policy decisions. 

One thing to note is that prior to the CCAil 2011 requirements, all supervisory stress tests 
imposed the same scenarios on all banks (i.e., a one-size-fits-all approach to stress testing). 
In recognition of the problem, the 2011 and 2012 CCAR asked banks to submit results 
from their own scenarios in addition to the supervisory stress scenario in an attempt to 
reveal bank-specific vulnerabilities. 
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Key Concepts 


L0 56.1 

After the 2007-2009 financial crisis, it was clear that traditional risk measures such as 
regulatory capital ratios were insufficient. Supervisory stress-testing became an important 
risk-assessment tool at that point. 

The goal of stress testing is to assess how much capital and liquidity a financial institution 
needs to support its business (i.e., risk taking) activities. 

The 2009 U.S. bank stress test, known as the Supervisory Capital Assessment Program 
(SCAP), was the first macro-prudential stress test after the 2007-2009 financial crisis. 

Disclosure was a significant feature of the 2009 SCAP. This high level of disclosure lead to 
transparency and allowed investors and the market the ability to check the severity of the 
stress tests and the outcomes of the stress at the individual bank level. 

In 2011, CCAR required only macro-scenario results be published, not bank level results, 
differing significantly from the 2009 SCAP requirements. The 2012 CCAR disclosed 
virtually the same amount and detail of bank level stress data as the 2009 SCAP. The EBA 
Irish and the EBA Europe required significant disclosures as well. The disclosures were 
needed to increase trust in the European banking system. 


LO 56.2 

One of the challenges regulators face is designing coherent stress tests. The sensitivities 
and scenarios must be extreme but must also be reasonable and possible (i.e., coherent). 
Problems are inherently multi-factor, making it more difficult to design a coherent stress 
test. 


LO 56.3 

Current stress tests are based on macro-scenarios (i.e., unemployment, GDP growth, the 
HPI). One concern is how to translate the macro-risk factors employed in stress tests into 
micro (i.e., bank specific) outcomes related to revenues and losses. Supervisors must be 
able to map from macro-factors into intermediate risk factors that drive losses in specific 
products and geographic areas. 

In a stress model, the starting balance sheet generates the first quarter s income and loss 
from the stressed scenario, which in turn determines the quarter-end balance sheet. The 
bank must maintain its capital (and liquidity) ratios during all quarters of the stress test 
horizon, typically two years. 
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Concept Checkers 


1. Which of the following changes in stress testing was not the result of the 2009 
Supervisory Capital Assessment Program (SCAP)? 

A. Banks are now required to provide the results of their own scenario stress tests. 

B. Stress scenarios are now broader in nature. 

C. Stress testing now focuses on the whole firm. 

D. Stress testing now focuses on revenues, costs, and losses. 

2. Piper Hook, a bank examiner, is trying to make sense of stress tests done by one of 
the banks she examines. The stress tests are multi-factored and complex. The bank 
is using multiple extreme scenarios to test capital adequacy, making it difficult for 
Hook to interpret the results. One of the key stress test design challenges that Hook 
must deal with in her examination of stress tests is: 

A. multiplicity. 

B. efficiency. 

C. coherence. 

D. efficacy. 

3. Greg Nugent, a regulator with the Office of the Comptroller of the Currency, 
is presenting research on stress tests to a group of regulators. He is explaining 
that macro-variable stress testing can be misleading for some banks because of 
geographical differences in macro risk factors. He gives the example of the wide 
range of unemployment rates across the U.S. following the 2007—2009 financial 
crisis. Which type of loan did Nugent most likely identify as having losses tied to 
unemployment rates? 

A. Residential real estate loans. 

B. Credit card loans. 

C. Commercial real estate loans. 

D. Industrial term loans. 

4. A risk modeler has to make assumptions about acquisitions and spinoffs, if dividend 
payments will change, and if the bank will buy back stock or issue stock options to 
employees. These factors make it especially challenging to: 

A. get a CAMELS rating of 2 or better. 

B. determine if the bank has enough liquidity to meet its obligations. 

C. meet the Tier 1 equity capital to risk-weighted assets ratio. 

D. model a banks balance sheet over a stress test horizon. 

5. One of the key differences between the 2011 CCAR stress test and the 2011 EBA 
Irish stress test is that: 

A. the CCAR did not require banks to provide results from their own stress 
scenarios. 

B. the EBA Irish did not find any banks in violation of capital adequacy 
requirements. 

C. the CCAR required disclosure of macro-level, not bank level, scenario results. 

D. the EBA Irish allowed for 1-year stress horizons. 
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Concept Checker Answers 


1. A The 2009 U.S. bank stress test, known as the Supervisory Capital Assessment Program 

(SCAP), was the first macro-prudential stress test after the 2007-2009 financial crisis. 

The 2011 CCAR, not the 2009 SCAP, required that banks provide results of their own stress 
scenarios along with supervisory stress scenarios. 

2. C One of the challenges of designing useful stress tests is coherence. The sensitivities and 

scenarios must be extreme but must also be reasonable or possible (i.e., coherent). Problems 
are inherently multi-factored, making it more difficult to design a coherent stress test. Hook 
is dealing with the possibly incoherent results of the banks stress tests. 

3. B Credit card losses are particularly sensitive to unemployment figures. For example, 

unemployment was 12.9% in Nevada in July 2011, 3.3% in North Dakota, and the national 
unemployment rate was 9.1%. Credit card loss rates varied dramatically from region to 
region during this period. Residential mortgages are affected by unemployment as well but 
people are generally more likely to quit paying credit card bills before mortgages. 

4. D In a stress model, the starting balance sheet generates the first quarter’s income and loss from 

the stressed scenario, which in turn determines the quarter-end balance sheet. At that point 
the person modeling the risk must consider if any assets will be sold or originated, if capital 
is depleted due to other actions such as acquisitions or conserved as the result of a spin¬ 
off, if there are changes made to dividend payments, if shares will be repurchased or issued 
(e.g., employee stock or stock option programs), and so on. This makes it challenging to 
model the balance sheet over the stress horizon. 

5. C The 2011 CCAR required banks to provide results from their own stress scenarios but the 

EBA Irish did not. After the 2011 EBA Irish tests, €24 billion was required to increase the 
capital of several banks. The 2011 CCAR, unlike the SCAP and the 2012 CCAR, only 
required the disclosure of macro-level scenario results. The EBA Irish did not change the 
stress horizon from two years to one year. 


Page 258 


©2018 Kaplan, Inc. 





The following is a review of the Operational and Integrated Risk Management principles designed to address 
the learning objectives set forth by GARP®. This topic is also covered in: 


Guidance on Managing 
Outsourcing Risk 


Topic 57 

Exam Focus 

This short and nontechnical topic begins by examining the general risks arising from a 
financial institutions use of service providers. It then provides details on the key elements 
of an effective service provider risk management program. For the exam, focus on the three 
broad areas of due diligence. Also, be familiar with the details from the numerous contract 
provisions that should be addressed with third-party service providers. 


LO 57.1: Explain how risks can arise through outsourcing activities to third- 
party service providers, and describe elements of an effective program to manage 
outsourcing risk. 


Risks of Outsourcing Activities to Third-Party Service Providers 

The following risks could arise when a financial institution outsources its operational 
functions to third-party service providers: 

• Compliance risk refers to a service provider not operating in compliance with the 
relevant local laws and regulations. 

• Concentration risk refers to having very few service providers to choose from or that the 
service providers are clustered in only a few geographic areas. 

• Reputational risk refers to a service provider executing its tasks in a substandard manner, 
resulting in a negative public perception of the financial institution. 

• Country risk refers to using a service provider based in a foreign country and subjecting 
the financial institution to potential economic and political risks in that country. 

• Operational risk refers to potential losses sustained by a financial institution as a result of 
internal control breaches and human error caused by a service provider. 

• Legal risk refers to subjecting the financial institution to lawsuits and other costs due to 
potentially negligent activities of a service provider. 

Effective Program to Manage Outsourcing Risk 

The risk management program with service providers needs to contain adequate oversight 
and controls over activities that have a material impact on the institutions finances and 
operations. In addition, importance must be placed on activities relating to sensitive 
customer information and new products and services. The depth and complexity of 
the program may be relatively low if there are few outsourced activities, and the service 
providers are established and reliable. Conversely, the depth and complexity may be 
relatively high if there are many service providers involved in outsourced activities. 
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Risk management programs should include (1) risk assessments, (2) due diligence in selecting 
service providers, (3) contract provisions, (4) incentive compensation review, (5) oversight 
and monitoring of service providers, and (6) business continuity and contingency plans. 

The last five elements will be discussed in subsequent sections. The crucial first step is to 
perform risk assessments of the applicable business activities to determine whether these 
activities are best executed in-house or by a third party. Assuming the outsourcing option 
is consistent with the financial institutions business objectives, then a cost-benefit analysis 
and a risk analysis of the service provider should be performed. Two key questions to be 
answered include the following: (1) Do qualified and experienced service providers exist? (2) 
Is the financial institution sufficiently qualified to perform oversight duties and manage the 
relationship with the service provider? Risk mitigation techniques should be updated on a 
sufficiently regular basis as a result of updated risk assessments. 


Due Diligence on Service Providers 


LO 57.2: Explain how financial institutions should perform due diligence on third- 
party service providers. 


In performing due diligence on a third-party service provider, a financial institution should 
involve any relevant technical specialists and/or important stakeholders. The three key 
areas of review include (1) business background, reputation, and strategy; (2) financial 
performance and condition; and (3) operations and internal controls. Ultimately, the 
financial institution must ensure that the service provider follows all relevant laws and 
regulations in performing services on the institutions behalf. 

Business Background, Reputation, and Strategy 

There should be a review of the potential service provider s past business history and of its 
key management personnel. The service provider should provide evidence of an adequate 
background check system for its new employees. 

A review of the service providers experience, strategy and mission statement, service 
philosophy, methods of maintaining and improving quality, and company policies is 
needed. The flexibility and feasibility of the service providers business model should be 
evaluated to determine the likelihood of providing services to the financial institution for 
the long term. 

References should be contacted and confirmed, and any licenses and certifications necessary 
to perform the services should be confirmed. A search for any past or present legal and 
compliance problems should also be undertaken. 

Financial Performance and Condition 

The service provider s most recent financial statements (and annual report, if applicable) 
should be obtained to analyze its assets, liabilities, liquidity, and operating performance for 
sufficiency. Financial information of any subcontractors should be obtained and analyzed 
for the same reason. The expected financial impact of the potential contract on the service 
provider should be determined. 
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The service providers long-term survival prospects should be analyzed by considering how 
long it has been operating as well as its market share growth. Furthermore, its ability to 
provide the service for the length of the contract in terms of capital and personnel needs 
to be ascertained. Finally, the amount of insurance coverage and any other issues that may 
impact the service provider s finances should be considered. 

Operations and Internal Controls 

The service providers internal controls, IT systems development and support, IT 
security systems, and methods of securing confidential information should be evaluated. 

Additionally, there should be a review of the service provider s staff training, analysis of the 
service support provided, and confirmation that employee background checks are being 
performed. Finally, queries should be made about the process involved in maintaining 
records and any disaster recovery processes in place. 


Contract Provisions 


LO 57.3: Describe topics and provisions that should be addressed in a contract 
with a third-party service provider. 


Considerations and contract provisions for third-party service providers should include the 
following elements: 

Scope. A contract will state the rights and responsibilities of each party. Examples include 
(1) contract duration, (2) support, maintenance, and customer service, (3) training of 
financial institution employees, (4) policies regarding subcontracting, (5) insurance 
coverage, and (6) policies regarding the use of the financial institutions assets and 
employees. 

Cost and compensation. A contract should indicate the party (or parties) responsible for the 
payment of any equipment purchases, legal fees, and audit fees pertaining to the service 
providers activities. In addition, there should be a listing of all forms of compensation (i.e., 
fixed, variable, special charges). 

Incentive compensation. A contract should include a provision to allow the financial 
institution to review the appropriateness of incentive compensation (if applicable). 
Specifically, the service provider may be involved in sales on behalf of the financial 
institution. Therefore, the incentives should be structured to ensure that the service provider 
places the interests of the customers (i.e., suitable financial products) over their own 
interests (i.e., earning higher fees) and to ensure that the service provider does not expose 
the financial institution to excessive risks. 

Right to audit. A contract could optionally contain a provision to allow the financial 
institution to audit the service provider. It may also require the receipt of various audit 
reports [e.g., American Institute of Certified Public Accountants (AICPA) Service 
Organization Control 2 report. Federal Financial Institutions Examination Council 
(FFIEC) Technology Service Provider examination report] relating to the service provider at 
stipulated intervals. 
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Establishment and monitoring of performance standards. A contract should state specific and 
measurable performance standards (i.e., metrics) with regard to the service providers work. 

Oversight and monitoring. A contract should include a provision requiring the service 
provider to provide annual financial statements (and the annual report, if applicable) to 
the financial institution to allow the financial institution to monitor the service providers 
ability to continue as a going concern. In addition, a provision should be included to allow 
the financial institution to increase monitoring and oversight activities when performance 
deficiencies, control weaknesses, and viability concerns are noted. With regard to higher- 
risk service providers, a contract could stipulate extra reporting by the service provider or 
additional monitoring by the financial institution. 

Confidentiality and security of information. A contract must contain extensive provisions 
concerning the confidentiality and security of information pertaining to both the financial 
institution and its customers. The service provider should only be given such information 
that is necessary to perform its tasks. Specifically, in the United States, the FFIEC guidance 
and section 501(b) of the Gramm-Leach-Bliley Act must be followed and should be noted 
in the contract. 

With regard to nonpublic personal information (NPPI) pertaining to the financial 
institutions customers, a contract should address access, security, and retention of NPPI 
data by the service provider (if applicable) to comply with privacy laws and regulations. A 
contract should also require the service provider to give notice to the financial institution 
of any breaches of data. In that regard, a contract needs to clarify the parties’ roles and 
responsibilities pertaining to NPPI data. 

Ownership and license. A contract should state when service providers are permitted to use 
the financial institution’s property (i.e., data and equipment). In addition, clarification is 
needed regarding the ownership and control of data produced by a service provider. In the 
event of software purchased from a service provider, it could be necessary to have escrow 
agreements in place so that the financial institution could access the source code and 
programs under certain conditions, such as discontinued product support or insolvency of a 
service provider. 

Indemnification. A contract should require the service provider to indemnify (i.e., hold 
harmless) the financial institution in the event of any legal proceedings arising from the 
service provider’s negligence. 

Default and termination. A contract should clarify the types of actions that would 
constitute a default together with any reasonable remedies that could be undertaken by 
the financial institution and methods to overcome default by the service provider. In 
terms of termination, common reasons, such as change in control, poor performance, and 
nonperformance of duties, should be explained and measured. There should be a provision 
that requires the service provider to give sufficient notice of termination to the financial 
institution in the event of a termination by the service provider. Finally, it is important 
to include provisions detailing the service provider’s requirement to return the financial 
institution’s data, records, and any other property. 
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Dispute resolution. A contract should lay out an agreed-upon dispute resolution plan to 
resolve disputes quickly and minimize disruption during a dispute. 

Limits on liability. A contract may allow for service providers to limit their liability subject 
to approval by the financial institutions board of directors and management team. 

Insurance. A contract should stipulate the requirement of service providers to carry sufficient 
insurance and provide evidence of coverage. In addition, any significant changes in coverage 
should be communicated to the financial institution. 

Customer complaints. A contract should state which party will deal with customer 
complaints. If it is the service provider, then they should be required to prepare reports to 
the financial institution listing the complaints and their status. 

Business resumption and contingency plan of the service provider. A contract should detail 
how the service provider will continue to provide services should a major disaster occur. 

The focus should be on critical services and any necessary alternative arrangements. Other 
items, such as backups, disaster recovery and business continuity plans, responsibility for 
maintaining and testing of such plans, and frequency of testing of such plans, should be 
included. 

Foreign-based service providers. A contract could attempt to provide for the law and 
regulations of only one jurisdiction (i.e., the financial institutions) to apply for the purposes 
of contract enforcement and resolution of disputes. This would avoid potentially confusing 
situations where the foreign laws differ substantially from local laws. 

Subcontracting. The subcontractor should be held to the same contract terms in the event 
that subcontracting is permitted. The contract should explicitly state that the primary 
service provider is ultimately responsible for all the work performed by the service provider 
and its subcontractors. The contract should provide a list of acceptable tasks that may 
be subcontracted and how the primary service provider will supervise and review the 
subcontractors work. Finally, the primary service providers method of performing financial 
due diligence on the subcontractor should be documented in the contract. 
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Key Concepts 


L0 57.1 

The following risks could arise when a financial institution outsources its operational 
functions to third-party service providers: (1) compliance risk, (2) concentration risk, 

(3) reputation risk, (4) country risk, (5) operational risk, and (6) legal risk. 

An effective program to manage outsourcing risk should include (1) risk assessments, 

(2) due diligence in selecting service providers, (3) contract provisions, (4) incentive 
compensation review, (5) oversight and monitoring of service providers, and (6) business 
continuity and contingency plans. 


LO 57.2 

In performing due diligence on a third-party service provider, a financial institution should 
involve any relevant technical specialists and/or important stakeholders. The three key 
areas of review include (1) business background, reputation, and strategy; (2) financial 
performance and condition; and (3) operations and internal controls. 


LO 57.3 

Considerations and provisions that should be addressed in a contract with a third-party 
service provider include the following: (1) scope, (2) cost and compensation, (3) incentive 
compensation, (4) right to audit, (5) establishment and monitoring of performance 
standards, (6) oversight and monitoring, (7) confidentiality and security of information, 
(8) ownership and license, (9) indemnification, (10) default and termination, (11) dispute 
resolution, (12) limits on liability, (13) insurance, (14) customer complaints, (15) business 
resumption and contingency plan of the service provider, (16) foreign-based service 
providers, and (17) subcontracting. 
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Concept Checkers 


1. Bank Inc, (Bank) operates in the United States and has a service contract in place 
with Service Co. (Service), which operates in France. Service manages a significant 
amount of confidential customer data for Bank, and recently a computer glitch at 
Service resulted in the accidental public disclosure of confidential customer data. As 
a result of the data breach, which of the following risks is Bank least likely to face? 

A. Compliance risk. 

B. Country risk. 

C. Legal risk. 

D. Operational risk. 

2. Which of the following statements regarding risk management programs with service 
providers to manage outsourcing risk is correct? 

A. The program should focus on business continuity and contingency plans. 

B. The program should contain more detail if there are only a few outsourced 
activities to established service providers. 

C. The program should contain adequate oversight and controls over all activities 
that impact the financial institution. 

D. The program should require risk assessments to be updated as a result of 
updated risk mitigation techniques on a sufficiently regular basis. 

3. When performing due diligence on a service provider, ascertaining the sufficiency 
of its insurance coverage would most appropriately be covered under which of the 
following categories? 

A. Business background, reputation, and strategy. 

B. Financial performance and condition. 

C. Operations and internal controls. 

D. Oversight and monitoring. 

4. The use of performance metrics to assist in determining an acceptable level of 
performance by a service provider would most appropriately be included in which of 
the following provisions of a contract with a financial institution? 

A. Customer complaints. 

B. Default and termination. 

C. Indemnification. 

D. Right to audit. 

5. Which of the following provisions would a financial institution least likely include in 
a contract with a third-party service provider? 

A. Establishment and monitoring of performance standards. 

B. Indemnification. 

C. Ownership and license. 

D. Right to audit. 
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Concept Checker Answers 


1. B Country risk refers to using a service provider based in a foreign country and subjecting the 

financial institution to potential economic and political risks in that country. Clearly, it is not 
a relevant risk arising from the breach of confidential customer data. 

Compliance risk is a possibility given the apparent lack of security controls of the service 
provider that resulted in the data breach. Operational risk is clearly a relevant risk to the 
financial institution here given the data breach caused by the service provider. Legal risk 
is clearly a relevant risk given that the customers affected by the data breach may sue the 
financial institution as a result of the breach. 

2. A Unexpected events could result in the inability of the service provider to provide its services 

to the financial institution. Depending on the nature and importance of the services 
provided, the financial institution may be exposed to substantial losses as a result of the 
inability of the service provider to provide its services. Therefore, business continuity and 
contingency plans should be a key focus in any risk management program with service 
providers. 

The program should contain less detail if there are only a few outsourced activities to 
established service providers given that the risk to the financial institution would be reduced 
substantially as a result of the service provider being established. The program should not deal 
with all activities that impact the financial institution but instead focus only on those that 
have a material impact. The program should require risk mitigation techniques to be updated 
on a sufficiently regular basis as a result of updated risk assessments. 

3. B A review of a potential service provider’s financial performance and condition would include 

queries regarding its level of insurance coverage. 

The area of business background, reputation, and strategy takes a more global view of the 
service provider and would be far less concerned with financial matters such as insurance. 
Operations and internal controls deal with compliance with relevant laws and regulations, 
for example, and would be less concerned with financial matters such as insurance. Oversight 
and monitoring is not an element within the due diligence process, but it is one of the 
elements (together with due diligence) of an effective risk management program with service 
providers. 

4. B With regard to the default and termination provision, common reasons include poor 

performance and nonperformance of duties, which would be detected through the use of 
performance metrics. The customer complaints provision deals with which party will deal 
with customer complaints. The indemnification provision deals with the service provider 
to indemnify the financial institution in the event of any legal proceedings arising from the 
service providers negligence. The right to audit provision deals with allowing the financial 
institution to audit the service provider. 

5. D The right to audit provision is optional and is the least important provision of the four listed. 

The use of performance standards is essential for monitoring and oversight purposes that 
may result in the determination of default by the service provider and possible termination 
of the contract. The indemnification provision is important because it deals with the service 
provider indemnifying (i.e., holding harmless) the financial institution in the event of any 
legal proceedings arising from the service providers negligence. The ownership and license 
provision is crucial because it would state when service providers are permitted to use the 
financial institutions property (i.e., data and equipment) as well as clarify the ownership and 
control of data produced by a service provider. 
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The following is a review of the Operational and Integrated Risk Management principles designed to address 
the learning objectives set forth by GARP®. This topic is also covered in: 

Basel I, Basel II, and Solvency II 


Topic 58 

Exam Focus 

This topic provides an overview of the international capital standards put in place by the 
Basel Committee on Banking Supervision. Basel I (1988) contained the first steps toward 
risk-weighting bank activities on- and off-balance sheet to relate required capital to risk. 

Basel I was the first to set a capital to risk-weighted assets requirement, but it only considered 
credit risk, not market or operational risk. Basel II took a more sophisticated approach to 
measuring bank credit risk, market risk, and operational risk. For the exam, understand 
the contribution Basel II makes to risk measurement, and know the differences between 
the methods used to calculate various risks. Also, know the difference between Basel II 
and Solvency II, a similar international standard for insurance companies, and the likely 
repercussions a firm will face if it breaches the standards. In addition, be able to calculate a 
banks required capital under the various regimes. One of the recurring themes in this topic is 
the difference between a standardized approach for measuring risk, used by less sophisticated 
banks (and insurance companies), and an internal approach that is firm specific and more 
complex but often lowers required capital because it allows banks to use their own model 
inputs and considers the correlations between assets. 


LO 58.1: Explain the motivations for introducing the Basel regulations, including 
key risk exposures addressed, and explain the reasons for revisions to Basel 
regulations over time. 


Prior to 1988, bank capital regulations were inconsistent across countries and ignored the 
riskiness of individual banks. Requirements were stated as minimum ratios of capital to 
total assets or as maximum ratios of total assets to capital. Some countries and/or regulatory 
authorities were more diligent in their enforcement of capital regulations than others. As 
banks became increasingly global, banks operating in countries with more lax standards 
were perceived to have a competitive advantage over banks operating in countries with strict 
enforcement of capital regulations. 

There were additional problems with the existing regime. First, high risk loans from 
international banks to lesser developed countries such as Mexico and Brazil raised 
questions about the adequacy of existing capital to cover potential losses. Second, banks 
used “accounting games” to record some of these transactions, masking risk. Third, bank 
transactions were becoming more complex. Off-balance sheet transactions in over-the- 
counter (OTC) derivatives like interest rate swaps, currency swaps, and options were 
growing. These off-balance sheet deals did not affect total assets, and thus did not affect 
the amount of capital a bank was required to keep, providing fuel to the growing belief that 
total assets did not reflect a banks total risk. In 1988, the Basel Committee put forth its 
first guidance to set international risk-based capital adequacy standards, called the 1988 BIS 
Accord, now commonly known as Basel I. 
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Basel I 


LO 58.2: Explain the calculation of risk-weighted assets and the capital 
requirement per the original Basel I guidelines. 


Basel I put forth two capital requirements: 

1. The banks total assets to capital ratio had to be less than 20 (i.e., capital to total 
assets had to be greater than 1/20 or 5%). This capital requirement was similar to the 
requirements in many countries prior to 1988. 

2. The banks on- and off-balance sheet items had to be used to calculate risk-weighted 
assets (RWA). RWA is intended to measure a banks total credit exposure. The ratio of 
capital to risk-adjusted assets is called the Cooke ratio, after Peter Cooke from the Bank 
of England. Basel I stipulated that the Cooke ratio must exceed 8%. 

Most banks met the first requirement. However, the risk-based capital requirement (i.e., the 
second requirement) was the key change to capital regulation. The process for calculating 
risk-weighted assets includes assigning a risk weight that reflects the banks credit risk 
exposure, to each of the on- and off-balance sheet items. A sample of some of the risk 
weights assigned to various asset categories is shown in Figure 1. 


Figure 1: Risk Weights for On-Balance Sheet Items 


Risk Weight (%) 

Asset Category 

0% 

Cash, gold, claims on Organisation of Economic Co-operation and 
Development (OECD) countries such as U.S. Treasury bonds and insured 
residential mortgages 

20% 

Claims on OECD banks and government agencies like U.S. agency 
securities or municipal bonds 

50% 

Uninsured residential mortgages 

100% 

Loans to corporations, corporate bonds, claims on non-OECD banks 


Example: Risk-weighted assets 

The assets of Blue Star Bank consist of $20 million in U.S. Treasury bills, $20 million in 
insured mortgages, $50 million in uninsured mortgages, and $150 million in corporate 
loans. Using the risk weights from Figure 1, calculate the banks risk-weighted assets. 

Answer: 

(0.0 X $20) + (0.0 X $20) + (0.5 X $50) + (1.0 x $150) = $175 million 
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Off-balance sheet items are expressed as a credit equivalent amount. The credit equivalent 
amount is, in essence, the loan principal that is considered to have the same credit risk. This 
means the bank “converts” off-balance sheet items into on-balance sheet equivalents for the 
purpose of calculating risk-based capital. The weight is then multiplied by the principal 
amount (i.e., the credit equivalent amount) of the item to arrive at a risk-weighted value. A 
conversion factor is applied to the principal amount of the instrument for non-derivatives. 

Off-balance sheet items that are similar, from a credit perspective, to loans (e.g., bankers 
acceptances), have a conversion factor of 100%. Other off-balance sheet items, such as note 
issuance facilities, have lower conversion factors. 

For interest rates swaps and other over-the-counter (OTC) derivatives, the credit equivalent 
amount is calculated as: 


max(V, 0) -h a X L 
where: 

V = current value of the derivative to the bank 
a = add-on factor 
L = principal amount 

The first term in the equation [max(V, 0)] reflects the banks current exposure. If the 
counterparty defaults and V, the current value of the derivative, is positive, the bank will 
lose V. If the counterparty defaults and Vis negative, the exposure is 0 (i.e., no gain or loss 
to the bank). The add-on amount (a x L) allows for the possibility that the banks exposure 
may increase in the future. Add-on factors are higher for higher risk derivatives (e.g., longer 
maturities, riskier underlying assets). A sample of add-on factors is shown in Figure 2. 


Figure 2: Add-on Factors as a Percent of Principal for Derivatives 


Remaining Maturity 
in Years 

Interest Rate 

Exchange Rate 
and Gold 

Equity 

Other 

Commodities 

< 1 year 

0.0 

1.0 

6.0 

10.0 

1 to 5 years 

0.5 

5.0 

8.0 

12.0 

> 5 years 

1.5 

7.5 

10.0 

15.0 


Example: Credit equivalent amounts for ofF-balance sheet items 

Blue Star Bank has entered a $175 million interest rate swap with a remaining maturity 
of three years. The current value of the swap is $2.5 million. Using the add-on factors in 
Figure 2, calculate the swap s credit equivalent amount. 

Answer: 

The add-on factor is 0.5% of the interest rate swap principal. 

credit equivalent amount = $2.5 + (0.005 x $175) = $3,375 million 
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The credit equivalent amount is multiplied by the risk weight for the counterparty to 
calculate risk-weighted assets. Risk weights are similar to those shown in Figure 1 with the 
exception of corporate counterparties. If the counterparty is a corporation, the risk weight 
50%. If the counterparty is an OECD bank, the risk weight is 20%. 


Example: Calculating risk-weighted assets for an ofF-balance sheet item 


In the previous example, Blue Star Bank entered an interest rate swap that had a credit 
equivalent amount of $3,375,000. Calculate the risk-weighted assets assuming (1) the 
counterparty is an OECD bank and (2) the counterparty is a corporation. 


Answer: 


RWA assuming counterparty is an OECD bank: $3,375,000 x 0.2 = $675,000 
RWA assuming counterparty is a corporation: $3,375,000 x 0.5 = $1,687,500 


The total RWAs of the bank are calculated by summing the on- and off-balance sheet risk- 
weighted items as follows: 

N M 

i=l j=l 

where: 

w- = the risk weight of the counterparty of the kh on-balance sheet item 
L. = principal of the kh on-balance sheet item 

Wj = the risk weight of the counterparty of theyth ofF-balance sheet item 
Cj = credit equivalent amount of theyth off-balance sheet item 

The bank must maintain at least 8% capital to risk-weighted assets. 


Example: Calculating risk-based capital 

Using the information from the previous three examples, calculate Blue Star Banks 
required capital, assuming the swap counterparty is a corporation. 

Answer: 


($175 million + $1.6875 million) x 0.08 = $14,135 million 
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According to Basel I, capital has two components, Tier 1 capital and Tier 2 capital. 

Tier 1 capital (or core capital) consists of items such as: 

• Equity (subtract goodwill from equity). 

• Non-cumulative perpetual preferred stock. 

Tier 2 capital (or supplementary capital) consists of items such as: 

• Cumulative perpetual preferred stock. 

• Certain types of 99-year debentures. 

• Subordinated debt with an original maturity greater than five years (where the 
subordination is to depositors). 

Equity capital (i.e., Tier 1) absorbs losses. Supplementary capital (i.e.. Tier 2) is subordinate 
to depositors and thus protects depositors in the event of a bank failure. At least 50% 
of capital must be Tier 1. This means there is a 4% Tier 1 capital to risk-weighted assets 
requirement (i.e., 8% x 0.5). Half of the Tier 1 requirement has to be met with common 
equity. Under Basel I, some countries required banks to have more capital than required by 
The Accord. 


Professor's Note: Basel I had a number of shortcomings that were remedied 
over the coming years with new capital accords. For example, Basel I treats all 
corporate loans the same in terms of capital requirements. The creditworthiness 
of the borrower is ignored. Also, Basel I did not include a model of default 
correlation. 


Market Risk Capital Requirements 


LO 58.3: Describe and contrast the major elements—including a description of 
the risks covered—of the two options available for the calculation of market risk 
capital: 

• Standardized Measurement Method 

• Internal Models Approach 


The goal of the 1996 Amendment to the 1988 Basel Accord was to require banks to 
measure market risks associated with trading activities and maintain capital to back those 
risks. Banks must mark-to-market {i.t.,fair value accounting bonds, marketable equity 
securities, commodities, foreign currencies, and most derivatives that are held by the bank 
for the purpose of trading (referred to as the trading book}. Banks do not have to use fair 
value accounting on assets they intend to hold for investment purposes (referred to as 
the banking book). This includes loans and some debt securities. The 1996 Amendment 
proposed two methods for calculating market risk: 

1. Standardized Measurement Method. 

2. Internal Model-Based Approach. 
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Standardized Measurement Method. This method assigns a capital charge separately to 
each of the items in the trading book. It ignores correlations between the instruments. 
Banks with less sophisticated risk management processes are more likely to use this 
approach. 

Internal Model-Based Approach. This method involves using a formula specified in the 
amendment to calculate a value at risk (VaR) measure and then convert the VaR into a 
capital requirement. Capital charges are generally lower using this method because it better 
reflects the benefits of diversification (i.e., correlations between the instruments). As such, 
banks with more advanced risk management functions prefer the internal models approach. 

Risks covered by the VaR model include movements in broad market variables such as 
interest rates, exchange rates, stock market indices, and commodity prices. 

The VaR model does not incorporate company-specific risks such as changes in a firms 
credit spread or changes in a company’s stock price. The specific risk charge (SRC) captures 
company-specific risks. For example, a corporate bond has interest rate risk, captured 
by VaR, and credit risk, captured by the SRC. Tier 3 capital consisting of short-term 
subordinated, unsecured debt with an original maturity of at least two years could be used 
to meet the market risk capital requirement at the time of the amendment. Tier 3 capital 
has subsequently been eliminated under Basel III. 


LO 58.4: Calculate VaR and the capital charge using the internal models approach, 
and explain the guidelines for backtesting VaR. 


According to the 1996 Amendment, the market risk VaR is calculated with a 10-trading day 
time horizon and a 99% confidence level. The market risk capital requirement is calculated 
as: 


max(VaR^_p m^ x VaR^^^) + SRC 
where: 

VaR^_^ = previous day’s VaR 

V^avg “ average VaR over the past 60 trading days 
m^ = multiplicative factor 

SRC = specific risk charge 

The multiplicative factor must be at least three, but may be set higher by bank supervisors 
if they believe a bank’s VaR model has deficiencies. This means the capital charge will be 
the higher of either the previous day’s VaR or three times the average of the daily VaR plus a 
charge for company specific risks (i.e., the SRC). 

Banks calculate a 10-day, 99% VaR for SRC. Regulators then apply a multiplicative factor 
(which must be at least four) similar to m^ to determine the capital requirement. The total 
capital requirement for banks using the internal model-based approach must be at least 
50% of the capital required using the standardized approach. 
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The banks total capital charge, according to the 1996 Amendment, is the sum of the capital 
required according to Basel I, described in LO 58.2, and the capital required based on the 
1996 Amendment, described in this LO. For simplicity, the RWAs for market risk capital 
was defined as 12.5 times the value given in the previous equation. The total capital a bank 
has to keep under the 1996 Amendment is: 


total capital = 0.08 x (credit risk RWA + market risk RWA) 
where: 

market RWA = 12.5 x (max(VaR^_p m^ x VaR^^^) + SRC) 

credit RWA = E(RWA on-balance sheet) + I](RWA off-balance sheet) 

Example: Market risk capital charge 

A bank calculates the previous days market risk VaR as $10 million. The average VaR 
over the preceding 60 trading days is $8 million. The specific risk charge is $5 million. 
Assuming a multiplicative factor of three, calculate the market risk capital charge. 

Answer: 

market risk capital charge = 0.08 x {12.5 x [(3 x $8 million) -i- $5 million]} 

= $29 million 


Backtesting 

The 1996 Amendment requires banks to backtest the one-day, 99% VaR over the previous 
250 days. A bank calculates the VaR using its current method for each of the 250 trading 
days and then compares the calculated VaR to the actual loss. If the actual loss is greater 
than the estimated loss, an exception is recorded. The multiplicative factor (m^) is set based 
on the number of exceptions. If, over the previous 250 days, the number of exceptions is: 

• Less than 5, m^ is usually set equal to 3. 

• 5, 6, 7, 8, or 9, m^ is set equal to 3.4, 3.5, 3.65, 3.75, and 3.85, respectively. 

• Greater than 10, m^ is set equal to 4. 

The bank supervisor has discretion regarding the multiplier. If the exception is due to 
changes in the banks positions during that day, the higher multiplier may or may not be 
used. If the exception is due to deficiencies in the banks VaR model, higher multipliers are 
likely to be applied. There is no guidance to supervisors in terms of higher multipliers if an 
exception is simply the result of bad luck. 
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Credit Risk Capital Requirements 


LO 58.5: Describe and contrast the major elements of the three options available 
for the calculation of credit risk capital: 

• Standardized Approach 

• Foundation IRB Approach 

• Advanced IRB Approach 

LO 58.8: Define in the context of Basel II and calculate the worst-case default rate 
(WCDR). 


Basel II specifies three approaches that banks can use to measure credit risk: 

1. Standardized approach. 

2. Foundation internal ratings based (IRB) approach. 

3. Advanced IRB approach. 

The Standardized Approach 

The standardized approach is used by banks with less sophisticated risk management 

functions. The risk-weighting approach is similar to Basel I, although some risk weights 

were changed. Significant changes include: 

• OECD status is no longer considered important under Basel II. 

• The credit ratings of countries, banks, and corporations are relevant under Basel II. 

For example, sovereign (country) risk weights range from 0% to 150%, and bank and 
corporate risk weights range from 20% to 150%. 

• Bank supervisors may apply lower risk weights when the exposure is to the country in 
which the bank is incorporated. 

• Bank supervisors may choose to base risk weights on the credit ratings of the countries 
in which a bank is incorporated rather than on the banks credit rating. For example, if 
a sovereign rating is AAA to AA-, the risk weight assigned to a bank is 20%. The risk 
weight increases to 150% if the country is rated below B— and is 100% if the country’s 
bonds are unrated. 

• Risk weights are lower for unrated countries, banks, and companies than for poorly rated 
countries, banks, and companies. 

• Bank supervisors who elect to use the risk weights in Figure 3 are allowed to lower the 
risk weights for claims with maturities less than three months. For example, the risk 
weights for short-maturity assets may range from 20% if the rating is between AAA to 
BBB-or unrated, to 150% if the rating is below B-. 

• A 75% risk weight is applied to retail loans, compared to 100% under Basel I. A 100% 
risk weight is applied to commercial real estate loans. The uninsured residential mortgage 
risk weights are 35% under Basel II, down from 50% under Basel I. 

A sample of risk weights under the standardized approach is presented in Figure 3. 
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Figure 3: Risk Weights (as a Percent) Under Basel IIs Standardized Approach 
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Collateral Adjustments 

Banks adjust risk weights for collateral using the simple approach, similar to Basel I, or the 
comprehensive approach, used by most banks. Under the simple approach, the risk weight 
of the collateral replaces the risk weight of the counterparty. The counterparty’s risk weight 
is used for exposure not covered by collateral. Collateral must be revalued at least every six 
months. A minimum risk weight of 20% is applied to collateral. Using the comprehensive 
approach, banks adjust the size of the exposure upward and the value of the collateral 
downward, depending on the volatility of the exposure and of the collateral value. 


Example: Adjusting for collateral using the simple approach 

Blue Star Bank has a $100 million exposure to Monarch, Inc. The exposure is secured by 
$80 million of collateral consisting of AAA-rated bonds. Monarch has a credit rating of 
B. The collateral risk weight is 20% and the counterparty risk weight is 150%. Using the 
simple approach, calculate the risk-weighted assets. 

Answer: 

(0.2 X 80) + (1.5 X 20) = $46 million risk-weighted assets 


Example: Adjusting exposure and collateral using the comprehensive approach 

Blue Star Bank assumes an adjustment to the exposure in the previous example of + 15% 
to allow for possible increases in the exposures. The bank also allows for a -20% change in 
the value of the collateral. Calculate the new exposure using the comprehensive approach. 

Answer: 

(1.15 X 100) - (0.8 X 80) = $51 million exposure 
Applying a risk weight of 150% to the exposure: 

1.5 X 51 = $76.5 million risk-weighted assets 


©2018 Kaplan, Inc. 


Page 275 








Topic 58 

Cross Reference to GARP Assigned Reading — Hull, Chapter 15 

The Internal Ratings Based (IRB) Approach 

United States regulators applied Basel II to large banks only. As such, regulatory authorities 
decided that the IRB approach must be used by U.S. banks. Under the IRB approach, the 
capital requirement is based on a VaR calculated over a one-year time horizon and a 99.9% 
confidence level. The model underlying this approach is shown in Figure 4. 


Figure 4: Capital Requirement 


VaR = loss at a very high 

confidence level (99.9%) expected loss 



The goal of the IRB approach is to capture unexpected losses (UL). Expected losses (EL) 
should be covered by the banks pricing (e.g., charging higher interest rates on riskier loans 
to cover EL). The capital required by the bank is thus VaR minus the banks EL. The VaR 
can be calculated using a Gaussian copula model of time to default. That is: 


WCDRi 


N~^PDi) + ^/pN~* (0.999) 


In this equation, WCDRj is the worst case probability of default. The bank can be 99.9% 
certain that the loss from the /th counterparty will not exceed this amount in the coming 
year. PD is the one-year probability of default of the obligor given a large number of 
obligors, and p is the copula correlation between each pair of obligors. 


Professor's Note: WCDR is called the worst case probability of default in the 
assigned reading. It is also called the worst case default rate, hence the acronym 
WCDR. 


Assuming the bank has a large portfolio of instruments such as loans and derivatives with 
the same correlation, the one-year, 99.9% VaR is approximately: 


VaR 


99.9%, 1—year 


EAD; X LGD; X WCDR; 
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EADj is the exposure at default of the counterparty or the dollar amount the 
counterparty is expected to owe if it defaults. For example, if the counterparty has a loan 
outstanding, EAD would likely be the principal amount outstanding on the loan at the time 
of default. LGDj is the loss given default for the counterparty or the proportion of the 
EAD. that is expected to be lost in the event of default. For example, if the bank expected to 
collect (i.e., recover) 40% in the event of default, the LGDj would be 60% (i.e., 1 - 0.4 = 

0 . 6 ). 

Recall from Book 2 that the expected loss (EL) from default is computed as: 

EL = y] EAD; X LGD; x PD; 
i 

The capital the bank is required to maintain is the excess of the worst-case loss over the 
banks expected loss defined as follows: 


required capital = y] EAD; X LGD; x(WCDRi - PD;) 
i 

Note that WCDR, PD, and LGD are expressed as decimals while EAD is expressed in 
dollars. 

Figure 5 shows the dependence of the one-year WCDR on PD and correlation, p. 


Figure 5: Dependence of One-Year, 99.9% WCDR on PD and p 
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It is clear from Figure 5 that WCDR increases as the correlation between each pair of 
obligors increases and as the probability of default increases. If the correlation is 0, then 
WCDR is equal to PD. 

Basel II assumes a relationship between the PD and the correlation based on empirical 
research. The formula for correlation is: 

P = 0.12x(1 + ^'-50xPD) 

Note that there is an inverse relationship between the correlation parameter and the PD. 
As creditworthiness declines, the PD increases. At the same time, the PD becomes more 
idiosyncratic and less affected by the overall market, thus the inverse relationship. 
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The relationship between WCDR and PD, as shown in Figure 6, is obtained by combining 
the previous equation with the calculation of WCDR. The WCDR increases as the PD 
increases, but not as fast as it would if the correlation were assumed to be independent of 
PD. 

Figure 6: Relationship Between WCDR and PD for Firm, Sovereign, and Bank Exposures 
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From a counterparty’s perspective, the capital required for the counterparty incorporates a 
maturity adjustment as follows: 


required capital = FAD x LCD x (WCDR - PD) x MA 
where: 

MA = maturity adjustment = (1 + (M - 2.5) x b)l{\ - 1.5 x ^) 

M = maturity of the exposure 

b = [0.11852-0.05478 xln(PD)]2 

The maturity adjustment, MA, allows for the possibility of declining creditworthiness and/ 
or the possible default of the counterparty for longer term exposures (i.e., longer than one 
year). If M = 1.0, then MA =1.0 and the maturity adjustment has no impact. The risk- 
weighted assets are calculated as 12.5 times capital required: 

RWA = 12.5 X [EAD x LCD x (WCDR - PD) x MA] 


The capital required is 8% of RWA. The capital required should be sufficient to cover 
unexpected losses over a one-year period with 99.9% certainty (i.e., the bank is 99.9% 
certain the unexpected loss will not be exceeded). Expected losses should be covered by the 
bank’s product pricing. Theoretically, the WCDR is the probability of default that happens 
once every 1,000 years. If the Basel Committee finds the capital requirements too high 
or too low, it reserves the right to apply a scaling factor (e.g., 1.06 or 0.98) to increase or 
decrease the required capital. 


Professor's Note: On the exam, if you begin with RWA, multiply by 0.08 to 
get the capital requirement. If instead you begin with the capital requirement, 
multiply by 12.5 (or divide by 0.08) to get RWA. In other words, these 
percentages are simply reciprocals (i.e., 1/0.08 = 12.5). 


Foundation IRB Approach vs. Advanced IRB Approach 

The foundation IRB approach and the advanced IRB approach are similar with the 
exception of who provides the estimates of LCD, EAD, and M. The key differences 
between the two approaches are outlined by the following. 
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Foundation IRB Approach 

• The bank supplies the PD estimate. For bank and corporate exposures, there is a 0.03% 
floor set for PD. 

• The LGD, EAD, and M are supervisory values set by the Basel Committee. The Basel 
Committee set LCD at 45% for senior claims and 75% for subordinated claims. If there 
is collateral, the LCD is reduced using the comprehensive approach described earlier. 

• The EAD is calculated similar to the credit equivalent amount required under Basel 1. It 
includes the impact of netting. 

• M is usually set to 2.5. 

Advanced IRB Approach 

• Banks supply their own estimates of PD, LCD, EAD, and M. 

• PD can be reduced by credit mitigants such as credit triggers subject to a floor of 0.03% 
for bank and corporate exposures. 

• LCD is primarily influenced by the collateral and the seniority of the debt. 

• With supervisory approval, banks can use their own estimates of credit conversion factors 
when calculating EAD. 

Foundations IRB Approach and Advanced IRB Approach for Retail Exposures 

• The two methods are merged for retail exposures. Banks provide their own estimates of 
PD, EAD, and LCD. 

• There is no maturity adjustment (MA) for retail exposures. 

• The capital requirement is EAD x LCD x (WCDR- PD). 

• Risk-weighted assets are 12.5 x EAD x LCD x (WCDR - PD). 

• Correlations are assumed to be much lower for retail exposures than for corporate 
exposures. 

Example: RWA under the IRB approach 

Assume Blue Star Bank has a $150 million loan to an A-rated corporation. The PD is 
0.1% and the LCD is 50%. Based on Figure 6, the WCDR is 3.4%. The average maturity 
of the loan is 2.5 years. Calculate the RWA using the IRB approach and compare it to the 
RWA under Basel 1. 

Answer: 

b = [0.11852 - 0.05478 x ln(0.001)]2 = 0.247 
MA= 1/ (1 -(1.5 X 0.247)) = 1.59 

risk-weighted assets = 12.5 x 150 x 0.5 x (0.034 - 0.001) x 1.59 = $49.19 million 

Under Basel I, the RWA for corporate loans was 100% or $150 million in this case. Thus, 
the IRB approach lowers the RWA for higher rated corporate loans, in this case from 
$150 million to $49.19 million. 
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Operational Risk Capital Requirements 


LO 58.6: Describe and contrast the major elements of the three options 
available for the calculation of operational risk capital: basic indicator approach, 
standardized approach, and the Advanced Measurement Approach. 


Basel II requires banks to maintain capital for operational risks. Operational risks include 
failures of the banks procedures that result in loss (e.g., fraud, losses due to improper 
trading activities). External events that result in loss, such as a fire, are also considered 
operational risks. 

Under Basel II, there are three approaches banks may use to calculate capital for operational 
risk: 

1. Basic indicator approach. 

2. Standardized approach. 

3. Advanced measurement approach. 

Basic Indicator Approach (BIA). This is the simplest approach and is used by banks with 
less sophisticated risk management functions. The required capital for operational risk is 
equal to the banks average annual gross income (i.e., net interest income plus non-interest 
income) over the last three years multiplied by 0.15. 

The Standardized Approach (TSA). This method is similar to the basic indicator approach. 
The primary difference between the two approaches is that a different multiplier is applied 
to the banks gross income for different lines of business. 

Advanced Measurement Approach (AMA). Like the IRB approach discussed for credit risk, 
the capital requirement for operational risk under the advanced measurement approach is 
based on an operational risk loss (i.e., VaR) calculated over a one-year time horizon with a 
99.9% confidence level. The approach has an advantage in that it allows banks to consider 
risk mitigating factors such as insurance contracts (e.g., fire insurance). 


Professor's Note: While Basel II generally lowered credit risk capital requirements 
for most banks, requiring banks to hold capital for operational risks had the 
effect of raising overall capital requirements back to (approximately) Basel I 
levels. 


Basel II Pillars of Sound Bank Management 


LO 58.7: Describe the key elements of the three pillars of Basel II: minimum 
capital requirements, supervisory review, and market discipline. 


While Basel I improved the way capital requirements were determined for banks worldwide, 
it had some major limitations. First, all corporate loans were treated the same (i.e., a risk 
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weight of 100%) regardless of the creditworthiness of the borrower. A firm with an AAA 
credit rating was treated the same as a borrower with a C rating. Basel I also ignored the 
benefits of diversification (i.e., there was no model of default correlation). Basel II, proposed 
in June 1999 and after multiple revisions was published in 2004 and implemented in 2007, 
corrected a number of the deficiencies in Basel I. The rules applied to “internationally 
active” banks and thus many small regional banks in the United States were not subject to 
the requirements but fell under Basel lA, similar to Basel I, instead. All European banks are 
regulated under Basel II. 

There are three pillars under Basel II: (I) minimum capital requirements, (2) supervisory 
review, and (3) market discipline. 

Pillar 1: Minimum Capital Requirements 

The key element of Basel II regarding capital requirements is to consider the credit ratings 
of counterparties. Capital charges for market risk remained unchanged from the 1996 
Amendment. Basel II added capital charges for operational risk. Banks must hold total 
capital equal to 8% of risk-weighted assets under Basel II, as under Basel I. Total capital 
under Basel II is calculated as: 


total capital = 0.08 x (credit risk RWA + market risk RWA + operational risk RWA) 


Pillar 2: Supervisory Review 

Basel II is an international standard, governing internationally active banks across the world. 
A primary goal of Basel II is to achieve overall consistency in the application of capital 
requirements. However, Pillar 2 allows regulators from different countries some discretion 
in how they apply the rules. This allows regulatory authorities to consider local conditions 
when implementing rules. Supervisors must also encourage banks to develop better risk 
management functions and must evaluate bank risks that are outside the scope of Pillar 1, 
working with banks to identify and manage all types of risk. 

Pillar 3: Market Discipline 

The goal of Pillar 3 is to increase transparency. Banks are required to disclose more 
information about the risks they take and the capital allocated to these risks. The key 
idea behind Pillar 3 is that if banks must share more information with shareholders (and 
potential shareholders), they will make better risk management decisions. Banks have 
discretion in determining what is relevant and material and thus what should be disclosed. 
According to Basel II, banks should disclose: 

• The entities (banks and other businesses such as securities firms in Europe) to which 
Basel II rules are applied. 

• A description of the characteristics, terms, and conditions of all the capital instruments 
held by the bank. 

• A list of the instruments comprising the banks Tier 1 capital. The amount of capital 
provided by each instrument should also be disclosed. 

• A list of the instruments comprising the banks Tier 2 capital. 
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• The capital requirements for each type of risk covered under Basel II: credit, market, and 
operational risks. 

• Information about other bank risks. 

• Information about the banks risk management function, how it is structured, and how it 
operates. 

Solvency II Framework 


LO 58.9: Differentiate between solvency capital requirements (SCR) and 
minimum capital requirements (MCR) in the Solvency II framework, and describe 
the repercussions to an insurance company for breaching the SCR and MCR. 


There are no international standards to regulate insurance companies. In Europe, Solvency I 
establishes capital requirements for the underwriting risks of insurance companies. Solvency 
II is expected to replace Solvency I and will consider operational and investment risks in 
addition to underwriting risks. While Solvency II was expected to be implemented in 2013, 
the date has been postponed. Solvency II has three pillars, analogous to Basel II. 

Pillar 1 specifies a solvency capital requirement (SCR). The SCR may be calculated using 
the standardized approach or the internal models approach (discussed in the next LO). 
Repercussions for breaching the SCR are less severe than if the firm breaches a minimum 
capital requirement (MCR). If the SCR falls below the required level, the insurance 
company will likely be required to submit a plan for restoring the capital to the required 
amount. Specific measures, determined by regulators, may be required. 

Pillar 1 also specifies a minimum capital requirement (MCR), which is an absolute 
minimum of capital. There are at least two methods for calculating the MCR under 
consideration. First, MCR may be set as a percentage of the SCR. A second possibility is to 
calculate MCR the same way as SCR, but with a lower confidence level. The repercussions 
for breaching the MCR are severe. If a firms capital falls below the MCR, regulators 
will likely prohibit the company from taking new business. Regulators can also force 
the insurance company into liquidation and transfer the company’s insurance policies to 
another firm. 


LO 58.10: Compare the standardized approach and the Internal Models Approach 
for calculating the SCR in Solvency II. 


The two approaches an insurance firm can use to calculate the SCR under Solvency II are: 

1. Standardized approach. 

2. Internal models approach. 

Standardized Approach. Analogous to Basel II, the standardized approach to calculating 
SCR under Solvency II is intended for less sophisticated insurance firms that cannot or 
do not want to develop their own firm-specific risk measurement model. It is intended to 
capture the risk profile of the average firm and is more cost efficient for smaller firms with 
less fully developed risk management functions. 
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Internal Models Approach. This approach is similar to the IRB approach under Pillar 1 of 
Basel II. A VaR is calculated with a one-year time horizon and a 99.5% confidence level. 

There is a capital charge for the following three types of risk: 

1. Underwriting risk: divided into risks arising from life insurance, non-life insurance (such 
as property and casualty insurance), and health insurance. 

2. Investment risk: divided into market risk and credit risk. 

3. Operational risk. 

Regulators have implemented quantitative impact studies (QISs) to examine whether capital 
is sufficient to weather significant market events. For example, QISs have considered large 
declines (i.e., 32%) in global stock markets, large declines (20%) in real estate prices, large 
increases (10%) or decreases (25%) in mortality rates, and so on. 

Internal models developed by insurance companies must satisfy the following three tests: 

1. Statistical quality test: This tests the quality of the data and the methodology the firm 
uses to calculate VaR 

2. Calibration test: This tests whether risks are measured in agreement with an industry¬ 
wide SCR standard. 

3. Use test: This test determines if the model is relevant and used by risk managers. 
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Key Concepts 


L0 58.1 

Prior to 1988, bank capital regulations were inconsistent across countries and ignored the 
riskiness of individual banks. In 1988, the Basel Committee put forth its first guidance to 
set international risk-based capital adequacy standards known as Basel I. 

Basel I was originally developed to cover credit risk capital requirements. It was amended in 
1996 to also include market risk capital requirements. Basel II was introduced in 2004 and 
addressed not only credit and market risk capital but also operational risk capital. 


LO 58.2 

Under Basel I, banks calculated risk-weighted assets for on- and off-balance sheet items. 
Capital was required as a percentage of risk-weighted assets. For example, cash and Treasury 
securities received a 0% risk weight while commercial loans received a 100% risk weight. 
Off-balance sheet items were expressed as credit equivalent amounts and were “converted” 
into risk-weighted assets. Capital could be Tier 1 or Tier 2 but at least half of the capital 
requirement (4%) had to be met with Tier 1 capital (equity and non-cumulative perpetual 
preferred). 


LO 58.3 

Banks were required to measure market risk in addition to credit risk under the 1996 
Amendment to the 1988 Basel Accord. The 1996 Amendment proposed two methods for 
calculating market risk including the standardized measurement method and the internal 
model-based approach. The standardized method assigns a capital charge separately to each 
of the items in the trading book. This method ignores correlations between the instruments. 
The internal model-based approach uses a formula specified in the amendment to calculate 
a value at risk (VaR) measure used to determine the capital requirement. Capital charges are 
generally lower using this method because it considers correlations between the instruments. 


LO 58.4 

According to the 1996 Amendment, the market risk VaR is calculated with a 10-trading-day 
time horizon and a 99% confidence level. The capital requirement for market risk is: 


max(VaR^_j, m^ x VaR^^^) + SRC 
where: 

VaR^ _ ^ = previous day s VaR 

VaR^^ = the average VaR over the past 60 days 

m^ = multiplicative factor, minimum value of three 

SRC = specific risk charge 

The 1996 Amendment requires banks to backtest the one-day, 99% VaR over the previous 
250 days. If the actual loss is greater than the estimated loss, an exception is recorded. The 
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multiplicative factor (m^) is set based on the number of exceptions. If, over the previous 250 
days, the number of exceptions is: 

• Less than 5, m^ is usually set equal to three. 

• 5, 6, 7, 8, or 9, m^ is set equal to 3.4, 3.5, 3.65, 3.75, and 3.85, respectively. 

• Greater than 10, m^ is set equal to four. 

The bank supervisor has discretion regarding the multiplier. 


LO 58.5 

Basel II improves on Basel I in at least two ways. First, counterparty credit ratings are 
considered in calculating risk-weighted assets. Second, a model of default correlation is 
included. Basel II specifies three approaches banks can use to measure credit risk, including 
the standardized approach, the foundation internal ratings based (IRB) approach, and the 
advanced IRB approach. The standardized approach is the least complicated and the risk¬ 
weighting approach is similar to Basel I, although some risk weights were changed. Under 
the IRB approach, the capital requirement is based on a VaR calculated over a one-year time 
horizon and a 99.9% confidence level. The foundation IRB approach and the advanced IRB 
approach are similar. The key difference is who supplies the input variables. Banks supply 
their own estimates of probability of default (PD), loss given default (LGD), exposure at 
default (EAD), and the maturity adjustment (M) if using the advanced approach. Under the 
foundation approach, banks supply PD estimates, while the Basel Committee supplies the 
estimates of LGD, EAD, and M. 


LO 58.6 

Basel II requires banks to maintain capital for operational risks. Operational risks include 
failures of the banks procedures that result in loss (e.g., fraud, losses due to improper 
trading activities). External events that result in loss, such as a fire that destroys bank 
assets or information, are also considered operational risks. Under Basel II, there are 
three approaches banks may use to calculate capital for operational risk including the 
basic indicator approach (the simplest), the standardized approach (similar to the basic 
indicator approach but with different multipliers applied to different lines of business), 
and the advanced measurement approach (the most complex). The capital requirement for 
operational risk under the advanced measurement approach is based on an operational risk 
loss calculated over a one-year time horizon and a 99.9% confidence level (i.e., VaR). The 
approach has an advantage in that it allows banks to consider risk mitigating factors such as 
insurance contracts. 
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LO 58.7 

Basel II is an international standard, governing “internationally active banks.” There are 

three pillars under Basel II as follows: 

1. Minimum capital requirements. This pillar involves calculating capital based on the 
riskiness of the bank, taking into consideration credit risk, market risk, and operational 
risk. 

2. Supervisory review. A primary goal of Basel II is to achieve overall consistency in the 
application of the capital requirements across countries while, at the same time, giving 
supervisors discretion to consider market conditions in their own countries. 

3. Market discipline. Banks are required to disclose more information about the risks they 
take and the capital allocated to those risks. According to Basel II, if banks must share 
more information with shareholders (and potential shareholders), they will make better 
risk management decisions. 


LO 58.8 

In the context of Basel II, the worst case probability of default (WCDR) is the amount the 
bank can be 99.9% certain the loss will not exceed (from a specific counterparty) in the 
coming year. The one-year probability of default (PD) is the probability that an obligor, 
given a large number of obligors, will default. The exposure at default (EAD) is the dollar 
amount a counterparty is expected to owe if it defaults. The loss given default (LGD) is the 
proportion of the EAD that is expected to be lost in the event the counterparty defaults. For 
example, if the bank expected to collect 40% in the event of default by a counterparty, the 
LGD is 60%. 


LO 58.9 

In Europe, Solvency I establishes capital requirements for the underwriting risks of 
insurance companies. Solvency II is expected to replace Solvency I and will consider 
operational and investment risks in addition to underwriting risks. Pillar 1 of Solvency II 
specifies: 

• Minimum capital requirement (MGR). The repercussions for breaching the MGR will 
likely include a prohibition from taking new business. Regulators may also force the 
insurance company into liquidation and transfer the company’s insurance policies to 
another firm. 

• Solvency capital requirement (SCR). Repercussions for breaching the SCR are less 
severe than if the firm breaches the MGR. If the SCR falls below the required level, the 
insurance company will likely be required to submit a plan for restoring the capital to 
the required amount. 


LO 58.10 

There are two approaches an insurance firm can use to calculate the SCR under Solvency II. 
They are the standardized approach and the internal models approach. The standardized 
approach is least complicated and is meant to capture the risk of the average firm. The 
internal models approach is similar to the IRB approach under Basel II. It involves 
calculating a VaR with a one-year time horizon and a 99.5% confidence level. 
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Concept Checkers 


1. Michigan One Bank and Trust has entered a $200 million interest rate swap with 
a corporation. The remaining maturity of the swap is six years. The current value 
of the swap is $3.5 million. Using the table below to find the add-on factor for the 
interest rate swap, the equivalent risk-weighted assets (RWA) under Basel I is closest 
to: 


Add-on Factors as a Percentage of Principal for Derivatives 


Remaining Maturity in Years 

Interest Rate 

Equity 

< 1 year 

0.0 

6.0 

1 to 5 years 

0.5 

8.0 

> 5 years 

1.5 

10.0 


A. $3,000,000. 

B. $3,250,000. 

C. $3,500,000. 

D. $6,500,000. 

2. Saugatuck National Bank uses the internal model-based approach to set market 
risk capital as prescribed by the 1996 Amendment to the 1988 Basel Accord. The 
bank has backtested its 99%, one-day VaRs against the actual losses over the last 
250 trading days. Based on the results of the backtesting, the bank recorded 11 
exceptions. Based on these results, the multiplicative factor (m^) in the model should 
be set: 

A. less than 3. 

B. equal to 3. 

C. between 3.1 and 3.9. 

D. equal to 4. 

3. Bank Macatawa has a $150 million exposure to Holland Metals Co. The exposure 
is secured by $125 million of collateral consisting of AA+-rated bonds. Holland 
Metals Co. is unrated. The collateral risk weight is 20%. Bank Macatawa assumes an 
adjustment to the exposure of + 15% to allow for possible increases in the exposure 
and allows for a -25% change in the value of the collateral. Risk-weighted assets for 
the exposure are closest to: 

A. $78.75 million. 

B. $93.75 million. 

C. $118.13 million. 

D. $172.50 million. 

4. Which of the following accords first required banks to hold capital for operational 
risk? 

A. Basel I. 

B. The 1996 Amendment to Basel I. 

C. Basel II. 

D. Solvency II. 
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5. Which of the following statements is correct regarding capital requirements for 

insurance companies? 

A. Basel II includes the regulation of banks and insurance companies in the three 
pillars. 

B. The minimum capital requirement is likely to be higher than the solvency 
capital requirement for insurance companies. 

C. The repercussion for violating the solvency capital requirement is likely 
liquidation and the transfer of company insurance policies to another firm. 

D. The internal models approach to calculating the solvency capital requirement is 
similar to internal ratings based approach under Basel II in that the firm must 
calculate a VaR with a one-year time horizon. 
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Concept Checker Answers 


1. B The add-on factor is 1.5% of the interest rate swap principal for swaps with a maturity 

greater than five years. 

credit equivalent amount = max(V,0) + a x L 
where: 

V = current value of the derivative to the bank 
A = add-on factor 
L = principal amount 

credit equivalent amount = $3.5 + (0.015 x $200) = $6,500,000 

The risk-weight factor for a corporate counterparty under Basel I is 50% for derivatives and 
100% for corporate loans. This means the risk-weighted assets (RWA) are: 

RWA = 0.50 X $6,500,000 = $3,250,000 

2. D Saugatuck National Bank must compare the VaR calculated using its current method 

for each of the 250 trading days to the actual loss over the same period to determine the 
multiplicative factor. If the actual loss is greater than the estimated loss, an exception is 
recorded. If, over the previous 250 days, the number of exceptions is: 

• Less than 5, m^ is usually set equal to three. 

• 5, 6, 7, 8, or 9, m^ is set equal to 3.4, 3.5, 3.65, 3.75, and 3.85, respectively. 

• Greater than 10, m^ is set equal to four. 

Therefore, with 11 exceptions recorded, m^ should be set equal to four. 

3. A Exposure = (1.15 x 150) - (0.75 x 125) = 172.5 - 93.75 = $78.75 

The risk weight for an unrated corporate counterparty based on Figure 3 in the topic is 
100%. Applying the 100% risk weight, risk-weighted assets are: 

risk-weighted assets = 1.0 x 78.75 = $78.75 million 

4. C Basel II requires banks to maintain capital for operational risks. Banks can use three methods 

to measure operational risk. They are the basic indicator approach, the standardized 
approach, and the advanced measurement approach. 

5. D Solvency II, not Basel II, establishes capital requirements for insurance companies. The 

minimum capital requirement (MGR) is just that, a true floor and is thus likely to be lower 
than the solvency capital requirement (SCR). The repercussion for violating the MCR is 
likely the prohibition of taking new business and possible liquidation. The repercussion for 
violating the SCR is the requirement of a plan to remedy the situation and bring the capital 
back to the required level. The internal models approach is similar to the internal ratings 
based approach under Basel II in that the insurance company must calculate a one-year VaR 
with a 99.5% confidence level (versus 99.9% confidence for banks under Basel II). 
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Topic 59 

Exam Focus 

Following the 2007-2009 financial crisis, the Basel Committee on Banking Supervision 
implemented reforms to shore up bank capital. This topic describes the measures taken in 
Basel II. 5 and Basel III to increase capital and tighten the definition of what constitutes 
capital in normal periods, create buffers to protect banks against loss in stress periods, and 
encourage banks to better manage liquidity risks by requiring banks to maintain liquidity 
coverage and net stable funding ratios. It also describes the major reforms in the Dodd- 
Frank Act that impact banks and bank regulation. For the exam, know the major changes to 
capital regulation, including the incremental risk charge, the comprehensive risk measure, 
the stressed VaR, the capital conservation buffer, and the countercyclical buffer. Understand 
why banks may use less mainstream funding sources, such as contingent convertible bonds, 
as a result of higher capital requirements. In addition, be able to calculate the leverage ratio, 
liquidity coverage ratio, and net stable funding ratio given a banks balance sheet. Finally, 
be able to recognize and describe major changes imposed on U.S. banks by Dodd-Frank, 
including the creation of the Financial Stability Oversight Council, the Office of Financial 
Research, and the Bureau of Financial Protection. 


Stressed VaR 


LO 59.1: Describe and calculate the stressed VaR measure introduced in Basel 2 . 5 , 
and calculate the market risk capital charge. 


The implementation of Basel II coincided with the financial crisis of 2007-2009. Some 
people blamed Basel II because banks using the advanced internal ratings based (IRB) 
approach to calculate credit risk were allowed to use their own estimates of probability of 
default (PD), loss given default (LCD), and exposure at default (FAD). Some believed 
Basel II was a move toward self-regulation and allowed banks to underestimate risks. As a 
result, the Basel Committee on Banking Supervision implemented a series of changes to 
the calculation of market risk capital. These changes were part of Basel II.5, implemented 
December 31, 2011. There were three primary changes, including: 

1. The calculation of a stressed value-at-risk (SVaR). 

2. The implementation of a new incremental risk change (IRC). 

3. A comprehensive risk measure (CRM) for instruments sensitive to correlations between 
default risks of various instruments. 

In the past, banks used the historical simulation method to calculate the VaR in order to 
find the market risk capital charge. The assumption in the historical simulation method 
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is that percentage changes in market variables the next day are random samples of the 
percentage changes over the previous one to four years. Volatilities of most market variables 
were low in the pre-crisis period (i.e., 2003—2006). As such, market risk VaRs were also low 
during this period and continuing for a time following the start of the financial crisis. To 
remedy the problem of low VaRs, Basel II.5 required banks to calculate two VaRs, the usual 
VaR, using the historical simulation method, and a stressed VaR, using a 250-day period 
of stressed market conditions. Initially, regulators thought the year 2008 would be ideal for 
stressed market conditions. However, banks are now required to identify a one-year period 
when their actual portfolios performed poorly. This means the stressed period may be 
different across banks. 

The total market risk capital charge is the sum of the usual bank VaR and the stressed VaR. 

The formula for the total capital charge is: 


max(VaR^_p m^ x VaR^^^) + max(SVaR^_p m^ x SVaR^^^) 


where: 
VaR , 


VaR 


avg 


SVaR^ 

SVaR., 


avg 


m 


= previous days VaR, 10-day time horizon, 99% confidence level 
= the average VaR over the past 60 days, 10-day time horizon, 99% confidence 
level 

= multiplicative factor, determined by supervisor, minimum value of three 
= previous days stressed VaR, 10-day time horizon, 99% confidence level 
= the average stressed VaR over the past 60 days, 10-day time horizon, 99% 
confidence level 

= stressed VaR multiplicative factor, determined by supervisor, minimum of 
three 


Example: Total market risk capital charge 

Spartan State Bank has calculated a market risk VaR for the previous day equal to 
$15.6 million. The average VaR over the last 60 days is $4.8 million. The bank has 
calculated a stressed VaR for the previous day equal to $17.7 million and an average 
stressed VaR equal to $18.4 million. Spartan State Bank has an accurate risk measurement 
model and recorded only two exceptions while backtesting actual losses against the 
calculated VaR. As such, the multiplicative factors, both m^ and m^ are set to 3. Calculate 
the total market risk capital charge. 

Answer: 

total capital charge = $15.6 million + ($18.4 x 3) = $70.8 million 


Professor's Note: Because the stressed VaR will be equal to ory more likely^ greater 
than, VaR, the capital charge for market risk under Basel IL 5 will be at least 
double the capital charge under Basel IL 
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Incremental Risk Capital Charge 


LO 59.2: Explain the process of calculating the incremental risk capital charge for 
positions held in a banks trading book. 


Prior to the financial crisis, the capital charge for exposures in the banks trading book 
(i.e., bonds, marketable equity securities, commodities, foreign currencies, and most 
derivatives that are held by the bank for the purpose of trading) was generally lower than 
the capital charge for exposures in the banking book (i.e., instruments the bank intends to 
hold for investment purposes including loans and some debt securities). A one-year, 99.9% 
confidence level VaR was required for calculating capital for the banking book while a 
multiplier was applied to a 10-day, 99% VaR for capital to back the trading book. 

The Basel Committee proposed an incremental default risk charge (IDRC) in 2005 to 
correct the problem. The proposal required a 99.9% confidence level, one-year time horizon 
VaR for instruments in the trading book that are sensitive to default risk. This change had 
the affect of requiring roughly the same capital for trading book instruments as banking 
book instruments. However, because much of the 2007—2009 losses in the financial sector 
were due not to defaults but instead to downgrades, widening credit spreads, and losses of 
liquidity, the Basel Committee revised the IDRC to become an incremental risk charge 
(IRC). Instead of instruments sensitive to default, it is now credit-sensitive instruments. 
Banks must consider ratings change sensitivities in addition to default sensitivity. Banks are 
expected to rebalance the portfolio through the year to lessen default risk. 

As part of the IRC calculation, banks are required to estimate a liquidity horizon for each 
instrument in the portfolio. For example, assume an AA-rated bond in the portfolio has 
a liquidity horizon of 6 months. If at the end of 6 months the bond has defaulted or has 
been downgraded, it is assumed that the bank will replace the bond with an AA-rated bond 
comparable to the one held at the start of the period. This rebalancing is assumed at the end 
of each six-month period (or three months, nine months, etc., depending on the estimated 
liquidity horizon). The Basel Committee set the minimum liquidity horizon at three 
months. 

This assumption of rebalancing to the beginning of the period position is known as the 
constant level of risk assumption. Small losses occur as bonds are downgraded and the 
portfolio is rebalanced, but the likelihood of default is lessened. Generally this assumption 
reduces the one-year, 99.9% VaR. As discussed in the previous topic, the specific risk charge 
(SRC) captures changing credit spreads. 


Comprehensive Risk Measure 


LO 59.3: Describe the comprehensive risk measure (CRM) for positions that are 
sensitive to correlations between default risks. 


The comprehensive risk measure (CRM) is a single capital charge for correlation- 
dependent instruments that replaces the specific risk charge (SRC) and the IRC. The 
measure accounts for risks in the “correlation book.” Instruments that are sensitive to the 
correlation between the default risks of different assets include asset-backed securities (ABS) 
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and collateralized debt obligations (CDOs). In normal periods, there is little risk of loss for 
highly rated tranches of these instruments. However, in times of stress, as in the 2007-2009 
financial crisis, correlations with other instruments increase and even the highest-rated 
tranches can be vulnerable to loss. 

The committee has specified a standardized approach for rated instruments. Due to the 
experience of the financial crisis, resecuritizations^ such as CDOs of ABSs, have higher 
capital requirements than normal securitizations such as mortgage-backed securities. 


Figure 1: Standardized Capital Charge for Correlation-Dependent Instruments 


Type of Instrument 

AAA to 
AA- 

A-t- to 

A- 

BBB->r to 

BBB- 

BB+ to 

BB- 

Below BB- or 
Unrated 

Securitization 

1.6% 

4% 

8% 

28% 

Deduction 

Resecuritization 

3.2% 

8% 

18% 

52% 

Deduction 


For unrated instruments or instruments rated below BB—, the bank must deduct the 
principal amount of the exposure from capital. This is equivalent to a 100% capital charge; 
banks must hold dollar-for-dollar capital against the tranche. For unrated tranches banks 
are allowed, with supervisory approval, to use an internal model to calculate the CRM. If 
a bank is allowed to use an internal model, it must routinely perform rigorous stress tests. 
Internal models must be sophisticated and capture the cumulative effects of several factors 
including: 

• Credit spread risk. 

• Multiple defaults. 

• The volatility of implied correlations. 

• The relationship between implied correlations and credit spreads. 

• The costs of rebalancing hedges. 

• The volatility of recovery rates. 

The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank) does not 
allow ratings to be used in setting capital requirements. As such, the United States is trying 
to devise its own CRM rules that do not use ratings. 


Professor's Note: For unrated and low rated (below BB—) instruments or 
tranches, the deduction of the principal amount of the exposure from capital 
is in essence assigning a 1250% risk weight to the asset class. Think about a 
$100 corporate loan that has a 100% risk weight. The capital charge is $8, or 
$100 x 100% X 0,08 (the asset value times the risk weight times the capital 
requirement). If instead you have a $100 unrated ABS CDO, the capital charge 
is $100, Another way to look at it is $100 x 1250% x 0,08, This lets you 
see the difference in the way that these low or unrated correlation dependent 
instruments are treated in terms of capital requirements, compared to traditional 
assets like loans. 
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Basel III Capital Requirements 


LO 59.4: Define in the context of Basel III and calculate where appropriate: 

• Tier 1 capital and its components 

• Tier 2 capital and its components 

• Required Tier 1 equity capital, total Tier 1 capital, and total capital 


Basel III increased capital for credit risk and tightened the definition of capital in response 
to the 2007-2009 financial crisis. The proposals were published in December 2010 and will 
be implemented gradually between 2013 and 2019. Basel III eliminated Tier 3 capital. 

Tier 1 capital (or core capital) includes: 

• Common equity including retained earnings (called Tier 1 equity capital or Tier 1 
common capital). 

• Non-cumulative perpetual preferred stock (additional Tier 1 capital, part of total Tier 1 
capital). 

Tier 1 capital does not include: 

• Goodwill. 

• Deferred tax assets. 

• Changes in retained earnings arising from securitized transactions. 

• Changes in retained earnings arising from the banks credit risk, called debit (debt) value 
adjustment (DVA). 

Tier 1 capital is adjusted downward to reflect defined benefit pension plan deficits (but is 
not adjusted upward for surpluses). In addition, there are rules governing capital issued by 
consolidated subsidiaries and also for the inclusion of minority interests. 

Tier 2 capital (or supplementary capital) includes: 

• Debt subordinated to depositors with an original maturity of five years or more. 

• Some preferred stock, such as cumulative perpetual preferred. 

Common equity is known as going-concern capital. It absorbs losses when the bank has 
positive equity (i.e., is a going concern). Tier 2 capital is known as gone-concern capital. 
When the bank has negative capital and is no longer a going concern. Tier 2 capital absorbs 
losses. Depositors are ranked above Tier 2 capital in liquidation so theoretically, as long as 
Tier 2 capital is positive, depositors should be paid in full. 

Capital requirements for each tier and for total capital are: 

• Tier 1 equity capital must be 4.5% of risk-weighted assets at all times. 

• Total Tier 1 capital (i.e., equity capital plus additional Tier 1 capital such as perpetual 
preferred stock) must be 6% of risk-weighted assets at all times. 

• Total capital (Total Tier 1 capital plus Tier 2 capital) must be at least 8% of risk- 
weighted assets at all times. 

By comparison, under Basel I the equity capital requirement was 2% of risk-weighted 
assets and the total Tier 1 capital requirement was 4% of risk-weighted assets. The new 
requirements are significantly more rigorous both because the percentages are higher and 
because the definition of what qualifies as equity capital has been tightened. The 8% 
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total capital requirement is the same as under Basel I and Basel II, but again, the stricter 
definition of equity capital applies under Basel III. 

The timeline for implementation for new capital requirements is shown in Figure 2. 


Figure 2: Implementation Dates for New Capital Requirements 


Regulatory Change 

111113 

1/1/14 

1/1/15 

1/1/18 

Tier 1 Equity Capital 

3.5% 

4.0% 

4.5% 

4.5% 

Tier 1 Total Capital 

4.5% 

5.5% 

6.0% 

6.0% 

New Capital Definitions 

Phased in 

Phased in 

Phased in 

New definitions fully in place 


Capital Conservation Buffer and Countercyclical Buffer 


LO 59.5: Describe the motivations for and calculate the capital conservation buffer 
and the countercyclical buffer introduced in Basel III. 


The capital conservation buffer is meant to protect banks in times of financial distress. 
Banks are required to build up a buffer of Tier 1 equity capital equal to 2.5% of risk- 
weighted assets in normal times, which will then be used to cover losses in stress periods. 
This means that in normal times a bank should have a minimum 7% Tier 1 equity capital 
ratio (i.e., 4.5% + 2.5% = 7.0%). Total Tier 1 capital must be 8.5% of risk-weighted assets 
and Tier 1 plus Tier 2 capital must be 10.5% of risk-weighted assets in normal periods. 
Banks need an extra cushion against loss during stress periods. The idea behind the buffer 
is that it is easier for banks to raise equity capital in normal periods than in periods of 
financial stress. The buffer will be phased in between January 1, 2016, and January 1, 2019. 

Dividend payments are constrained when the buffer is wholly or partially used up. For 
example, if a banks Tier 1 equity capital ratio is 6%, the bank must retain a minimum 
of 60% earnings, thus dividends cannot exceed 40% of earnings. See Figure 3 for the 
restrictions on dividend payments as they relate to the capital conservation buffer. 


Figure 3: Dividend Restrictions Resulting from the Capital Conservation Buffer 


Tier 1 Equity Capital Ratio 

Minimum Percentage of Retained Earnings 

4.000% to 5.125% 

100% 

5.125% to 5.750% 

80% 

5.75% to 6.375% 

60% 

6.375% to 7.000% 

40% 

> 7.0% 

0% 
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Professor's Note: While the buffer requires the ratios to be 7% (Tier 1 equity), 
8.5% (Total Tier 1 capital), and 10.5% (total capital) of risk-weighted assets, 
the ratios are expected to decline in times of market stress due to losses. At that 
point, the ratio requirements described in LO 59.4 are in force (i.e., 4.5%, 
6.0%, and 8.0%, respectively). However, once financial markets stabilize, 
banks will face pressure to increase the ratios again. Given the higher equity 
requirements under Basel III, it will likely be difficult for banks to achieve the 
high returns on equity (ROE) that they enjoyed in the 15 years leading up to the 
financial crisis (i.e., 1990 — 2006). 


While left to the discretion of individual country supervisors, Basel III also recommends 
that banks have a capital buffer to protect against the cyclicality of bank earnings, called 
the countercyclical buffer. The countercyclical buffer can range from 0% to 2.5% of risk- 
weighted assets. Like the capital conservation buffer, it must be met with Tier 1 equity 
capital. The buffer will be phased in between January 1, 2016, and January 1, 2019. 

For countries that require the countercyclical buffer, dividend restrictions may apply. See 
Figure 4 for the restrictions on dividend payments as they relate to the countercyclical 
buffer (when set to the maximum 2.5% of risk-weigh ted assets), keeping in mind that the 
ratios are higher because the capital conservation buffer is also included. In other words, 
Figure 4 is a revised Figure 3, taking the additional buffer into account. 


Figure 4: Dividend Restrictions Resulting from the Capital Conservation Buffer and a 
2.5% Countercyclical Buffer 


Tier 1 Equity Capital Ratio 

Minimum Percentage of Retained Earnings 

4.50% to 5.75% 

100% 

5.75% to 7.00% 

80% 

7.00% to 8.25% 

60% 

8.25% to 9.50% 

40% 

> 9.5% 

0% 


Liquidity Risk Management 


LO 59.6: Describe and calculate ratios intended to improve the management of 
liquidity risk, including the required leverage ratio, the liquidity coverage ratio, and 
the net stable funding ratio. 


In the wake of the 2007—2009 financial crisis, one of the primary goals of Basel III is to 
improve liquidity risk management in financial institutions. Basel III specifies a minimum 
leverage ratio (capital / total exposure) of 3%. As of the 2010 Basel III publication date, the 
type of capital required to calculate the ratio was not decided. Total exposure includes all 
items on the balance sheet, in their entirety (i.e., not risk-weighted). It also includes some 
off-balance sheet items such as loan commitments. 

Banks often finance long-term obligations with short-term funds such as commercial 
paper or repurchase agreements. This is fine during normal economic periods. However, 
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in times of financial stress, this mismatched financing gives rise to liquidity risk. Banks 
find it difficult to roll over the short-term financing when they have, or are perceived to 
have, financial problems. During the 2007-2009 financial crisis, liquidity risk, not a lack 
of capital, was the real problem for many banks (e.g., Lehman Brothers). Basel III requires 
banks to meet the following two liquidity ratios: (1) liquidity coverage ratio and (2) net 
stable funding ratio. 

Liquidity Coverage Ratio (LCR): The LCR focuses on the banks ability to weather a 30- 
day period of reduced/disrupted liquidity. The severe stress considered could be a three- 
notch downgrade (e.g., AA to A), a loss of deposits, a complete loss of wholesale funding, 
a devaluation of the value of collateral for funding agreements like repurchase agreements 
(i.e., increased ‘‘haircuts”)) and potential drawdowns on lines of credit. The ratio is 
computed as: 


high quality liquid assets / net cash outflows in a 30-day period > 100% 


Liquid assets need to be at least as great as potential net cash outflows such that the bank 
can withstand one or more of the pressures described earlier. 

Net Stable Funding Ratio (NSFR): The NSFR focuses on the banks ability to manage 
liquidity over a period of one year. The ratio is computed as: 


amount of available stable funding / amount of required stable funding > 100% 


To calculate the numerator, each source of funding (such as retail deposits, repurchase 
agreements, capital, and so on) is multiplied by a factor that reflects the relative stability of 
the funding source. See Figure 5 for the available stable funding (ASF) factors and types of 
funding available. 


Figure 5: ASF Factors in NSFR 


ASF Factor 

Category 

100% 

Tier 1 and Tier 2 capital, preferred stock, debt with remaining maturity greater than 
one year. 

90% 

“Stable” demand and term deposits from individuals and small businesses with 
maturities less than one year. 

80% 

“Less stable” demand and term deposits from individuals and small businesses with 
maturities less than one year. 

50% 

Wholesale funding (demand and term deposits) from nonfinancial corporations, 
sovereigns, central banks, multi-lateral development banks, and public sector entities 
with maturities less than one year. 

0% 

All other liability and equity categories. 
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To calculate the denominator, each required amount of stable funding is multiplied by a 
factor that reflects the relative permanence of the funding required. See Figure 6 for the 
required stable funding (RSF) factors and the types of assets requiring the funding. 


Figure 6: RSF Factors in NSFR 


RSF Factor 

Category 

0% 

Cash and short-term instruments, securities, and loans to financial entities with 
residual maturities of less than one year. 

5% 

Marketable securities with maturities of greater than one year, if claim is on a 
sovereign with 0% risk weight (e.g., U.S. Treasury securities). 

20% 

Corporate bonds with rating of AA- or higher and residual maturity greater than one 
year. Claims on sovereigns or similar bodies with risk-weight of 20%. 

50% 

Gold, equities, bonds rated A+ to A-. 

65% 

Residential mortgages. 

85% 

Loans to small businesses or retail customers with remaining maturities less than one 
year. 

100% 

All other assets. 


Example: Calculating the NSFR 


Bank of the Bluegrass has the following balance sheet: 


Cash (coins and banknotes) 

10 

Retail deposits (less stable) 

100 

Central bank reserves 

10 

Wholesale deposits 

75 

Treasury bonds (> 1 yr) 

10 

Tier 2 capital 

2 

Mortgages 

30 

Tier 1 capital 

18 

Retail loans (< 1 yr) 

30 



Small business loans (< 1 yr) 

90 



Fixed assets 

15 



Total assets 

195 

Total liabilities and equity 

195 


Using the information in Figures 5 and 6 to find the corresponding ASF and RSF factors, 
calculate the banks net stable funding ratio. 
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Answer: 

ASF = (100 X 0.8) + (75 x 0.5) + (2 x 1.0) + (18 x 1.0) = $137.50 

RSF = (10 X 0) + (10 X 0) + (10 X 0.05) + (30 x 0.65) + (30 x 0.85) + (90 x 0.85) + 
(15x1.0) = $137.00 

NSFR= 137.50 / 137.00 = 1.0036 = 100.36% 

With an NSFR greater than 100%, Bank of the Bluegrass satisfies the new liquidity 
requirement. 


These new rules represent a significant change for banks and will impact bank balance 
sheets. The LCR is scheduled to be implemented January 1, 2015, and the NSFR is 
scheduled to be implemented January 1, 2018. 


Contingent Convertible Bonds 


LO 59.7: Describe the mechanics of contingent convertible bonds (CoCos) and 
explain the motivations for banks to issue them. 


Contingent convertible bonds (CoCos), unlike traditional convertible bonds, convert to 
equity automatically when certain conditions are met. These bonds typically convert to 
equity when the company or bank is experiencing financial strains. The motivation for 
banks to issue CoCos is that during normal financial periods, the bonds are debt and thus 
do not drag down return on equity (ROE). However, in periods of financial stress, the 
bonds convert to equity, providing a cushion against loss, which helps prevent insolvency. 
The needed capital is provided by private sector bondholders rather than the government, 
allowing the bank to avoid a bailout. 

Potential triggers that activate conversion are: 

• The ratio of Tier 1 equity capital to risk-weighted assets. For example. Credit Suisse 
issued CoCos in 2011. Conversion is triggered if Tier 1 equity capital to risk-weighted 
assets falls below 7%. 

• Supervisors judgment about the issuing banks solvency prospects. For example, the 
Credit Suisse CoCos automatically convert if bank supervisors determine that the bank 
needs public sector aid (i.e., equity capital) to avoid insolvency. 

• A minimum ratio of a banks market capitalization to its assets. Market value triggers 
may reduce balance sheet manipulations (as one might see if the ratio of capital to 
risk-weighted assets is used as a trigger) but might instead introduce stock price 
manipulation. 
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Because of the increased pressure on banks to maintain higher capital levels under Basel III, 
it is estimated that more than $1 trillion of CoCos will be issued between 2010 and 2020. 

Dodd-Frank Street Reform 


LO 59.8: Explain the major changes to the US financial market regulations as a 
result of Dodd-Frank. 


The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank) was 

signed into law in July 2010. The act is intended to protect consumers from abuses and 

prevent future bailouts and/or collapses of banks and other financial firms. Dodd-Frank has 

several provisions aimed at regulating banks. Some of the major changes include: 

• The establishment of the Financial Stability Oversight Council (FSOC). The job of the 
FSOC is to look out for risks that affect the entire financial system. The body monitors 
systemic risks. 

• The establishment of the Office of Financial Research (OFR). The OFR conducts 
research on the state of the economy and it, along with the FSOC, identifies risks to the 
financial stability of the United States. The bodies seek to maintain investor confidence 
and promote market discipline. 

• The FSOC and the OFR are charged with identifying systemically important financial 
institutions (SIFIs). SIFIs must establish living wills that map out how the firm can be 
safely wound down in the event of failure. Banks that are considered too-big-to-fail must 
be identified and could be broken up under Dodd-Frank if their living wills are judged 
unacceptable. The FSOC can impose extra capital requirements on SIFIs. In the United 
States, a bank with more than $50 billion in assets qualifies as a SIFI. The definition is 
less clear for non-banks. 

• The elimination of the Office of Thrift Supervision, a former supervisory body that 
regulated savings and loan institutions. 

• The expansion of the Federal Deposit Insurance Corporations (FDIC s) powers to 
liquidate banks. For example, the FDIC is allowed to take over large firms that are failing 
and sell their assets, even at a loss to shareholders and creditors. The financial industry, 
not taxpayers, should bear the costs of failures. 

• Permanently increasing the FDIC deposit insurance limit from $100,000 to $250,000. 

• Greater reporting requirements for large hedge funds and similar firms. These firms must 
now register with the SEC. 

• The establishment of Federal Insurance Office that will work with state insurance 
regulators and monitor the insurance industry. 

• The establishment of the Volcker Rule, intended to curtail proprietary trading by 
institutions (like banks) that accept insured deposits as a source of funding. One of 
the problems with this rule is that it can be difficult to distinguish between a banks 
speculative trading and hedging activities. 

• The requirement that some financial firms spin off high-risk trading operations into 
separately capitalized subsidiaries. 
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• Increased regulation and improved transparency of over-the-counter (OTC) derivatives 
including requiring standardized OTC derivatives be cleared by exchanges or by 
central clearing parties (CCPs). To facilitate OTC trading, swap execution facilities 
(SEFs) were mandated. The Commodity Futures Trading Commission (CFTC) was 
given responsibility to monitor CCPs and SEFs. A trade repository of all derivatives 
transactions will be established, improving transparency. A new Legal Entity Identifier 
(LEI) system will be created to assist with this goal. An LEI is a reference code that 
identifies a legally distinct entity engaging in a financial transaction. 

• The Federal Reserve must set risk management standards for systemically important 
financial institutions engaged in clearing, settlement, and payment functions. 

• The requirement that rating agencies be more transparent in their assumptions and 
methods used to rate firms. An Office of Credit Ratings was created to monitor rating 
agencies. The potential legal liabilities of rating agencies were also increased under Dodd- 
Frank. 

• The use of external credit ratings in the regulation of banks and other financial 
institutions was banned. This is in direct conflict with the Basel Committee, which uses 
external credit ratings to set some capital requirements. 

• Individual protections were increased, both for investors and consumers. The Bureau of 
Financial Protection was created within the Federal Reserve to ensure that consumers 
understand loan applications and terms for things like mortgages and credit cards. 

The goal is that consumers receive clear and accurate information when they shop for 
financial products and services. 

• Firms are required, with some exceptions, to keep a minimum of 5% of the assets they 
securitize. 

• Changes in compensation. Compensation packages that encourage short-term 
performance goals that may lead to increased risk taking are discouraged. Shareholders 
were given a non-binding vote on executive compensation packages. Board 
compensation committees must be made up of independent directors. 

• Banks are required to assess a mortgage borrower s ability to repay. Foreclosures may be 
disallowed if a bank does not make a good faith effort to determine that the borrower 
can repay the loan. 

• At least one board member should have risk management experience at large, complex 
organizations. 
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Key Concepts 


L0 59.1 

Basel II.5 requires banks to calculate two market risk VaRs. The first is the usual VaR 
required in Basel II, using the historical simulation method. The second is a stressed VaR, 
using a 250-day period of stressed market conditions. To calculate the stressed VaR, banks 
must identify a one-year period when their portfolios performed poorly. The total market 
risk capital charge is the sum of the usual bank VaR and the stressed VaR. 


LO 59.2 

The Basel Committee proposed an incremental default risk charge (IDRC) in 2005 to 
correct for the fact that the banking book was attracting more capital than the trading book 
in most banks. For instruments in the trading book that are sensitive to default risk, the 
IDRC requires the bank to calculate a 99.9% confidence level, one-year time horizon VaR. 
This was altered to account for ratings change sensitivities in addition to default sensitivities 
following the 2007—2009 financial crisis and became known as the incremental risk charge 
(IRC). Banks must estimate a liquidity horizon for each instrument and rebalance the 
portfolio if credit quality declines. 


LO 59.3 

The comprehensive risk measure (CRM) accounts for risks in the correlation book. 
Asset-backed securities (ABS) and collateralized debt obligations (CDOs) are sensitive 
to the default risk of other assets. For example, they are sensitive to the default risk of 
the securitized assets that collateralize the instruments. The committee has specified a 
standardized approach to assign capital charges for rated instruments. Resecuritizations, 
such as CDOs of ABSs, have higher risk weights than normal securitizations, such as 
mortgage-backed securities. For unrated instruments or instruments rated below BB—, the 
bank must deduct the principal amount of the exposure from capital which is equivalent to 
a 100% capital charge. 


LO 59.4 

Basel III increased capital requirements for credit risk and tightened the definition of what 
qualifies as Tier 1 and Tier 2 capital. Basel III eliminated Tier 3 capital. Under Basel III, a 
banks total capital consists of Tier 1 equity capital (primarily common stock plus retained 
earnings), additional Tier 1 capital (primarily non-cumulative perpetual preferred), and Tier 
2 capital (primarily debt subordinated to depositors with an original maturity of at least 
five years). By January 1, 2015, Tier 1 equity capital must be at least 4.5% of risk-weighted 
assets, total Tier 1 capital must be 6% of risk-weighted assets, and total capital (Tier 1 plus 
Tier 2) must be at least 8% of risk-weighted assets. 
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LO 59.5 

The capital conservation buffer protects banks in times of financial distress. Banks are 
required to build up a buffer of Tier 1 equity capital equal to 2.5% of risk-weighted assets 
in normal times, which will then be used to cover losses in stress periods. This means that 
in normal times a bank should have a minimum 7% Tier 1 equity capital ratio. Total Tier 1 
capital must be 8.5% of risk-weigh ted assets and Tier 1 plus Tier 2 capital must be 10.5% 
of risk-weighted assets in normal periods. Dividend restrictions apply when capital ratios 
fall below required levels. 

Basel Ill also recommends that banks have a capital buffer to protect against the cyclicality 
of bank earnings, called the countercyclical buffer. This requirement is left to the discretion 
of individual country supervisors and can range from 0% to 2.5% of risk-weighted assets. 


LO 59.6 

One of the primary goals of Basel III is to improve liquidity risk management in financial 
institutions. Basel III requires banks to meet the following three liquidity ratios: 

1. A minimum leverage ratio (capital / total exposure) of 3%. Total exposure includes 
all items on the balance sheet in their entirety (i.e., not risk-weighted) and some off- 
balance sheet items, such as loan commitments. 

2. A minimum liquidity coverage ratio (high quality liquid assets / net cash outflows in 

a 30-day period) of 100%. The LCR focuses on the banks ability to weather a 30-day 
period of reduced/disrupted liquidity. 

3. A minimum net stable funding ratio (amount of stable funding / required amount of 
stable funding) of 100%. The NSFR focuses on the banks ability to manage liquidity 
over a period of one year. 


LO 59.7 

Contingent convertible bonds (CoCos) convert to equity automatically when certain 
conditions are met, usually when the company or bank is experiencing financial stresses. 
The motivation for banks to issue CoCos is that during normal financial periods, the bonds 
are debt and thus do not weigh down return on equity (ROE). However, in periods of 
financial stress, the bonds convert to equity, providing a cushion against loss and preventing 
insolvency and potentially allowing the bank to avoid a bailout. 
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LO 59.8 

Dodd-Frank was signed into law in July 2010. The act is intended to protect consumers 

from abuses and prevent future bailouts and/or collapses of banks and other financial firms. 

Dodd-Frank has many provisions aimed at regulating banks. Some of the more important 

provisions are as follows: 

• The establishment of the Financial Stability Oversight Council (FSOC). The job of the 
FSOC is to look out for risks that affect the entire financial system. 

• The establishment of the Office of Financial Research (OFR). The OFR conducts 
research on the state of the economy and it, along with the FSOC, identifies risks to the 
financial stability of the United States. 

• The FSOC and the OFR are charged with identifying systemically important financial 
institutions (SIFIs). SIFIs must establish living wills that map out how the firm can be 
safely wound down in the event of failure. Banks that are considered too-big-to-fail must 
be identified and could be broken up under Dodd-Frank if their living wills are judged 
unacceptable. SIFIs may also be required to hold additional capital. 

• Permanently increasing the FDIC deposit insurance limit from $100,000 to $250,000. 

• The establishment of the Volcker Rule, intended to curtail proprietary trading by banks. 

• The Bureau of Financial Protection was created within the Federal Reserve to ensure that 
consumers understand loan applications and terms for things like mortgages and credit 
cards. The goal is that consumers receive clear and accurate information when they shop 
for financial products and services. 

• Increased regulation and improved transparency for over-the-counter (OTC) derivatives 
including requiring standardized OTC derivatives be cleared by exchanges or by central 
clearing parties (CCPs). 
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Concept Checkers 


1. Which of the following statements about a stressed VaR, required under Basel II.5, is 
correct? 

A. Basel 11.5 has established the year 2008 as the “stress” period. All banks use data 
from 2008 to calculate the stressed VaR. 

B. The stressed VaR replaces the “normal” VaR for the purpose of calculating 
capital for credit risks. 

C. Market risk capital under Basel II.5 should be at least double that of market risk 
capital under Basel II due to the addition of the stressed VaR. 

D. The stressed VaR must be calculated using a 99.9% confidence interval. 

2. Banks are required to rebalance their portfolios as the creditworthiness of bonds 
decline, leading to losses over time but generally not to outright default. This 
requirement to specify a liquidity horizon for each instrument in the portfolio and 
rebalance at the end of the liquidity horizon is part of the: 

A. incremental risk charge calculation. 

B. net stable funding charge formula. 

C. countercyclical buffer estimation. 

D. comprehensive risk measure calculation. 

3. Which form of capital must be adjusted downward to reflect deficits in defined 
benefit pension plans under Basel III? 

A. Tier 1 capital. 

B. Tier 2 capital. 

C. Tier 3 capital. 

D. There is no requirement under Basel III to adjust capital downward to reflect 
deficits in defined benefit pension plans. 

4. The capital conservation buffer: 

A. is intended to protect banks from the countercyclical nature of bank earnings. 

B. can be set between 0.0% and 2.5% of risk-weighted assets, and is at the 
discretion of the regulators in individual countries. 

C. causes the Tier 1 equity capital ratio requirement to increase to 7% of risk- 
weighted assets in normal economic periods. 

D. requires that total capital to risk-weighted assets must be 10.5% at all times. 

5. Highlands Bank has estimated stable funding in the bank to be $100 million. The 
bank estimates that net cash outflows over the coming 30 days will be $137 million. 
The bank has capital of $5 million and a total exposure of $140 million. The bank 
estimates that it has high-quality liquid assets of $125 million. What is the banks 
liquidity coverage ratio (LCR)? 


A. 

89.3%. 

B. 

91.2%. 

C. 

73.0%. 

D. 

3.6%. 
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Concept Checker Answers 


1. C Basel II.5 required banks to calculate two VaRs, the usual VaR, using the historical 

simulation method, and a stressed VaR, using a 99% confidence level, 250-day period of 
stressed market conditions. The total market risk capital charge is the sum of the usual bank 
VaR and the stressed VaR. Initially, regulators thought the year 2008 would be ideal for 
stressed market conditions. However, banks are now required to identify a one-year period 
when their portfolios performed poorly. This means the stressed period may be different 
across banks. 

2. A As part of the incremental risk charge (IRC) calculation, banks are required to estimate a 

liquidity horizon for each instrument in the portfolio. For example, assume an AA+-rated 
bond in the portfolio has a liquidity horizon of three months. If, at the end of three months, 
the bond has defaulted or has been downgraded, it is assumed that the bank will replace the 
bond with an AA+-rated bond comparable to the one held at the start of the period. This 
rebalancing is assumed at the end of each three-month period (or six months, nine months, 
etc., depending on the estimated liquidity horizon). Rebalancing allows banks to take losses 
as instruments are downgraded but generally allows the bank to avoid defaults. 

3. A Tier 1 includes common equity including retained earnings (called Tier 1 equity capital or 

Tier 1 common capital) and non-cumulative perpetual preferred stock (additional Tier 1 
capital, part of total Tier 1 capital). Tier 1 capital does not include goodwill, deferred tax 
assets, changes in retained earnings arising from securitized transactions, or changes in 
retained earnings arising from the banks credit risk. Tier 1 capital is adjusted downward to 
reflect defined benefit pension plan deficits (but is not adjusted upward for surpluses). Tier 2 
or supplementary capital includes debt subordinated to depositors with an original maturity 
of five years or more. Tier 3 capital was eliminated under Basel III. 

4. C The capital conservation buffer is meant to protect banks in times of financial distress. Banks 

are required to build up a buffer of Tier 1 equity capital equal to 2.5% of risk-weighted assets 
in normal times, which will then be used to cover losses in stress periods. This means that 
in normal times, a bank should have a minimum 7% Tier 1 equity capital to risk-weighted 
assets ratio, an 8.5% total Tier 1 capital to risk-weighted assets ratio, and a 10.5% Tier 1 plus 
Tier 2 capital to risk-weigh ted assets ratio. The capital conservation buffer is a requirement 
and is not left to the discretion of individual country regulators. It is not a requirement at all 
times but is built up to that level in normal economic periods and declines in stress periods. 

5. B Basel III requires a minimum liquidity coverage ratio of 100%. The LCR focuses on the 

banks ability to weather a 30-day period of reduced/disrupted liquidity. The formula is 
computed as follows: 

high-quality liquid assets / net cash outflows in a 30-day period 
LCR = $125 million / $137 million = 0.912 or 91.2%. 

In this case. Highlands Bank does not meet the minimum 100% requirement and is in 
violation of the rule. 
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Topic 60 


Exam Focus 

The new banking capital requirements, as specified in this topic, will profoundly change the 
way that capital for market risk is calculated. There are several key innovations that will cause 
this change. First, banks will be required to forgo using the 99% confidence interval VaR 
measure in favor of the 97.5% confidence interval expected shortfall measure. This change 
will better capture the potential dollar loss (i.e., tail risk) that a bank could sustain in a given 
window of time. Many risk managers have already begun using expected shortfall in practice 
for internal audits. Second, risk assets will be divided into liquidity horizons that better 
reflect the volatility in specific asset categories. The third innovation is a rules-based criteria 
for an asset being categorized as either a trading book asset or a banking book asset. This step 
will help mitigate the potential for regulatory arbitrage. 


Market Risk Capital Calculation 


LO 60.1: Describe the proposed changes to the Basel market risk capital 
calculation and the motivations for these changes, and calculate the market risk 
capital under this method. 


In May 2012, the Basel Committee on Banking Supervision began considering the next 
round of changes to market risk capital calculations for banks. This process is known as the 
Fundamental Review of the Trading Book (FRTB). After receiving comments on proposals 
and seeing the results of a formal study, the rules were further refined in December 2014. 

It is important for risk managers to understand the nature of the proposed changes and the 
new calculation methodology. 

In order to properly understand the changes, it is necessary to first understand the previous 
market risk requirements. The Basel I calculations for market risk capital involved a 10-day 
value at risk (VaR) calculated with a 99% confidence interval. This process produced a 
very current result because the 10-day horizon incorporated a recent period of time, which 
typically ranged from one to four years. The Basel II. 5 calculations required banks to add 
a stressed VaR measure to the current value captured with the 10-day VaR. The stressed 
VaR measures the behavior of market variables during a 250-day period of stressed market 
conditions. Banks were required to self-select a 250-day window of time that would have 
presented unusual difficulty for their current portfolio. 

The FRTB researched if the 10-day VaR was really the best measurement for a banks true 
risk. The value at risk measure has been criticized for only asking the question: “How 
bad can things get?” VaR communicates, with a given level of confidence, that the banks 
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losses will not exceed a certain threshold. Consider a bank that uses a 10-day VaR with 
a 99% confidence interval and finds that losses will only exceed $25 million in 1% of 
all circumstances. What if the 1% chance involves a $700 million loss? This could be a 
catastrophic loss for the bank. Therefore, the FRTB has proposed an alternate measure 
using expected shortfall (ES), which is a measure of the impact on the profit and loss 
statement (P&L) for any given shock of varying lengths. The expected shortfall asks the 
question: “If things get bad, what is the estimated loss on the banks P&L?” 

Consider the following example that illustrates the difference between value at risk and 
expected shortfall. A bank has a $950 million bond portfolio with a 2% probability of 
default. The default schedule appears in Figure 1. 


Figure 1: Example Default Schedule for $950 Million Bond Portfolio 


Confidence Level 

Default 

Loss 

95% 

No 

$0 

96% 

No 

$0 

97% 

No 

$0 

98% 

No 

$0 

99% 

Yes 

$950 million 

99.9% 

Yes 

$950 million 


At the 95% confidence interval, there is still no expected loss, so the 95% VaR would imply 
a $0 of loss. However, the expected shortfall measure accounts for the potential dollar loss 
conditional on the loss exceeding the 95% VaR level. In this case, three out of five times 
the expected loss is still $0, but two out of five times the expectation is for a total loss of 
the $950 million bond portfolios value due to default. This means that 40% of the tail risk 
would yield a loss, so the expected shortfall is $380 million (i.e., 40% x $950 million). This 
presents a very different risk perspective than using the VaR measure alone. 

Instead of using a 10-day VaR with a 99% confidence interval, the FRTB is proposing the 
use of expected shortfall with a 97.5% confidence interval. For a normal distribution, with 
mean of p and standard deviation of a, these two measures yield approximately the same 
result. The 99% VaR formula is p + 2.326a, and the 97.5% expected shortfall formula is 
p + 2.338a. However, if distributions have fatter tails than a normal distribution, then the 
97.5% expected shortfall can be considerably different from the 99% VaR. 

Under this FRTB proposal, banks would be required to forgo combining a lO-day, 99% 
VaR with a 250-day stressed VaR, and instead calculate capital based on expected shortfall 
using a 250-day stressed period exclusively. Just as with the 250-day stressed VaR, banks 
would be charged with self-selecting a 250-day window of time that would be exceptionally 
difficult financially for the banks portfolio. 


Professor's Note: There are approximately 250 trading days in a 12-month time 
period. This is why 250-day time windows are used. Following the same logic, 
a 120-day window equates to six months, a 60-day window equates to one 
quarter (three months), a 20-day window equates to one month, and a 10-day 
window is essentially two weeks. 
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LO 60.2: Compare the various liquidity horizons proposed by the Fundamental 
Review of the Trading Book (FRTB) for different asset classes and explain how a 
bank can calculate its expected shortfall using the various horizons. 


According to the Basel Committee, a liquidity horizon (LH) is “the time required to 
execute transactions that extinguish an exposure to a risk factor, without moving the price of 
the hedging instruments, in stressed market conditions.” The standard 10-day LH was not 
deemed appropriate given the actual variations in liquidity of the underlying transactions. 
Five different liquidity horizons are now in use: 10 days, 20 days, 60 days, 120 days, and 
250 days. Consider the 60-day horizon, which is essentially three months worth of trading 
days. The calculation of regulatory capital for a 60-day horizon is intended to shelter a bank 
from significant risks while waiting three months to recover from underlying price volatility. 

Under FRTB proposals, every risk factor is assigned a liquidity horizon for capital 
calculations. For example, investment grade sovereign credit spreads are assigned a 20- 
day horizon, while non-investment grade corporate credit spreads are assigned a 120-day 
horizon and structured products have a 250-day horizon. See Figure 2 for a sample listing of 
liquidity horizons. 


Figure 2: Allocation of Risk Factors to Liquidity Horizons 


Risk Factors 

Horizon (in Days) 

Interest rate (EUR, USD, GBP, AUD, JPY, SEK, and CAD) 

10 

Interest rate (other) 

20 

Interest rate at-the-money (ATM) volatility 

60 

Credit spread: sovereign, investment grade 

20 

Credit spread: sovereign, non-investment grade 

60 

Credit spread: corporate, investment grade 

60 

Credit spread: corporate, non-investment grade 

120 

Credit spread: structured products 

250 

Equity price: large cap 

10 

Equity price: small cap 

20 

Equity price: large cap ATM volatility 

20 

Equity price: small cap ATM volatility 

120 

FX rate (liquid currency pairs) 

10 

FX rate (other currency pairs) 

20 

FX volatility 

60 

Energy price 

20 

Precious metal price 

20 

Energy price ATM volatility 

60 

Precious metal ATM volatility 

60 
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The Basel committee s original idea was to utilize overlapping time periods for stress testing. 
They initially wanted to find a time period s expected shortfall (ES) by scaling smaller time 
periods up to longer time periods using a series of trials. Consider a bank that has a 10- 
day risk asset, like large-cap equity, and a 120-day risk asset, like a non-investment grade 
corporate credit spread. In the first trial, they would measure the stressed P&L changes from 
Day 0 to Day 10 for the large-cap equity and also the value change from Day 0 to Day 120 
for the non-investment grade corporate credit spread. The next trial would measure the 
change from Day 1 to Day 11 on the large-cap equity and from Day 1 to Day 121 for the 
credit spread. The final simulated trial would measure Day 249 to Day 259 for the large- 
cap equity and Day 249 to Day 369 for the credit spread. The ES used would then be the 
average loss in the lower 2.5% tail of the distribution of the 250 trials. 


After the initial idea was submitted for comments, it was revised in December 2014 to 
incorporate five categories. The rationale was to reduce implementation costs. The updated 
categories are as follows: 

• Category 1 is for risk factors with 10-day horizons. 

• Category 2 is for risk factors with 20-day horizons. 

• Category 3 is for risk factors with 60-day horizons. 

• Category 4 is for risk factors with 120-day horizons. 

• Category 5 is for risk factors with 250-day horizons. 

Using this revised, categorical process attempts to account for the fact that risk factor shocks 
might not be correlated across liquidity horizons. 


This proposed new process is formally known as the internal models-based approach 
(IMA). In the internal models-based approach, expected shortfall is measured over a base 
horizon of 10 days. The expected shortfall is measured through five successive shocks to 
the categories in a nested pairing scheme using ES^ ES^ is calculated as a 10-day shock 
with intense volatility in all variables from category 1—5. ES 2 is calculated as a 10-day 
shock in categories 2—5, holding category 1 constant. ES^ is calculated as a 10-day shock 
in categories 3—5, holding category 1 and 2 constant. ES^ is calculated as a 10-day shock 
in categories 4—5, holding categories 1—3 constant. The final trial, ES^, is calculated as a 
10-day shock in category 5, holding categories 1—4 constant. The idea is to measure the 
hit to the banks P&L for ESj_^. The overall ES is based on a waterfall of the categories, as 
described above, and is scaled to the square root of the difference in the horizon lengths of 
the nested risk factors. This relationship is shown in the following formula: 


ES = 


ESf + E 


j=2 


ES:. 


f 10 


Until the internal models-based approach has been formally approved, banks must continue 
to use what is known as the revised standardized approach. This process groups risk assets 
with similar risk characteristics into “buckets,” which are essentially just organized around 
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liquidity horizons. The standardized risk measure for each bucket is then calculated using 
the following formula: 


+2j]J^PijWiWjViVj 

i i j<i 


where: 

z/j = the value of the /th risk factor 

w^ = 2 . weighting factor established by the Basel Committee 
pjj = the correlation established by the Basel Committee 

In order to find the regulatory capital, the standardized risk measures are then combined for 
each bucket. Regulators may require that capital calculated using the new internal models- 
based approach be at least some set percentage of the revised standardized approach. 


Proposed Modifications to Basel Regulations 


LO 60.3: Explain proposed modifications to Basel regulations in the following 
areas: 

• Classification of positions in the trading book compared to the banking book 

• Treatment of credit spread and jump-to-default risk, including the incremental 
default risk charge 

The FRTB also addressed regulatory modifications. One modification is to clarify if a risk 
asset should be considered part of the trading book or the banking book. Historically, the 
trading book consisted of risk assets that the bank intended to trade. Trading book assets 
have been periodically marked-to-market. The banking book has consisted of assets that are 
intended to be held until maturity, and they are held on the books at cost. Banking book 
assets are subject to more stringent credit risk capital rules, while trading book assets are 
subject to market risk capital rules. Using different rules has enabled a form of regulatory 
arbitrage where banks will hold credit-dependent assets in the trading book to relax capital 
requirements. 

In an attempt to mitigate this regulatory arbitrage, the FRTB makes a specific distinction 
between assets held in the trading book and those held in the banking book. To be allocated 
to the trading book, the bank must prove more than an intent to trade. They must meet 
dual criteria of: (1) being able to trade the asset, and (2) physically managing the associated 
risks of the underlying asset on the trading desk. If these two criteria are met, then an asset 
can be allocated to the trading book, but the day-to-day price fluctuations must also affect 
the banks equity position and pose a risk to bank solvency. 

Another important distinction was made in terms of reclassification between a banking 
book asset and a trading book asset. Once an asset has been acquired and initially assigned 
to either the trading book or the banking book, it cannot be reclassified except for 
extraordinary circumstances. This roadblock has been established to minimize the act of 
switching between categories at will, based on how capital requirements are calculated. 
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An example of an extraordinary circumstance is if the bank changes accounting practices 
that is a firm-wide shift. Another caveat is that any benefit derived from calculating capital 
requirements under a post-shift category is disallowed. The capital requirement of the 
original method must be retained. 

Basel II.5 also introduced the incremental risk charge (IRC) to further mitigate this 
regulatory arbitrage. The IRC recognizes two different types of risk created by credit- 
dependent risk assets: (1) credit spread risk, and (2) jump-to-default risk. 

Credit spread risk is the risk that a credit risk asset s credit spread might change and thus 
cause the mark-to-market value of the asset to change. This risk can be addressed by using 
the expected shortfall calculation process discussed earlier. The IRC process allows banks to 
assume a constant level of risk. This means that it is assumed that positions that deteriorate 
are replaced with other risk assets. For example, if a bank has an A-rated bond with a three- 
month liquidity horizon that suffers a credit-related loss, then it is assumed that the bank 
replaces this risk asset with another A-rated bond at the end of the three-month liquidity 
horizon. This is clearly a simplifying assumption, which is being replaced with incremental 
marking-to-market without assuming replacement under the FRTB proposals. 

Jump-to-default risk is the risk that there will be a default by the issuing company of the 
risk asset. A default would lead to an immediate and potentially significant loss for the bank 
that holds the defaulted issuers risk asset. This risk is subject to an incremental default risk 
(IDR) charge. The IDR calculation applies to all risk assets (including equities) that are 
subject to default. It is calculated based on a 99.9% VaR with a one-year time horizon. 
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Key Concepts 


LO 60.1 

The Fundamental Review of the Trading Book (FRTB) is changing the historical reliance 
on 10-day value at risk (VaR) with a 99% confidence interval combined with a 250-day 
stressed VaR. The new calculation will require the use of expected shortfall with a 97.5% 
confidence interval. This switch will better capture the value of capital at risk below a 
certain confidence interval. 


LO 60.2 

The FRTB is establishing various liquidity horizons, which are the length of time “required 
to execute transactions that extinguish an exposure to a risk factor, without moving the 
price of the hedging instruments, in stressed market conditions.” The expected shortfall will 
then be calculated by structuring risk assets into categories and solving for an overall value 
of expected shortfall for a banks risk assets. 


LO 60.3 

Some banks have engaged in regulatory arbitrage by actively switching assets between the 
trading book and the banking book depending on which category would show their capital 
requirements in a more favorable light. The FRTB is mitigating this arbitrage opportunity 
by deploying a rules-based standard for classification into these categories and a roadblock 
for easily switching between them. 
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Concept Checkers 


1. Which of the following statements regarding the differences between Basel I, Basel 
II. 5, and the Fundamental Review of the Trading Book (FRTB) for market risk 
capital calculations is incorrect? 

A. Both Basel I and Basel II. 5 require calculation of VaR with a 99% confidence 
interval. 

B. FRTB requires the calculation of expected shortfall with a 97.5% confidence 
interval. 

C. FRTB requires adding a stressed VaR measure to complement the expected 
shortfall calculation. 

D. The 10-day time horizon for market risk capital proposed under Basel I 
incorporates a recent period of time, which typically ranges from one to four years. 

2. What is the difference between using a 95% value at risk (VaR) and a 95% expected 
shortfall (ES) for a bond portfolio with $825 million in assets and a probability of 
default of 3%? 

A. Both measures will show the same result. 

B. The VaR shows a loss of $495 million while the expected shortfall shows no loss. 

C. The VaR shows no loss while the expected shortfall shows a $495 million loss. 

D. The VaR shows no loss while the expected shortfall shows a $395 million loss. 

3. Which of the following statements best describe how the internal models-based approach 
(IMA) incorporates various liquidity horizons into the expected shortfall calculation? 

A. A rolling 10-day approach is used over a 250-day window of time. 

B. Smaller time periods are used to extrapolate into larger time periods. 

C. A series of weights are applied to the various liquidity horizons along with a 
correlation factor determined by the Basel Committee. 

D. The expected shortfall is based on a waterfall of the liquidity horizon categories 
and is then scaled to the square root of the difference in the horizon lengths of 
the nested risk factors. 

4. Which of the following statements represents a criteria for classifying an asset into 
the trading book? 

I. The bank must be able to physically trade the asset. 

II. The risk of the asset must be managed by the banks trading desk. 

A. I only. 

B. II only. 

C. Both I and II. 

D. Neither I nor II. 

5. Which of the following risks is specifically recognized by the incremental risk charge 
(IRC)? 

A. Expected shortfall risk, because it is important to understand the amount of loss 
potential in the tail. 

B. Jump-to-default risk, as measured by 99% VaR, because a default could cause a 
significant loss for the bank. 

C. Equity price risk, because a change in market prices could materially impact 
mark-to-market accounting for risk. 

D. Interest rate risk, as measured by 97.5% expected shortfall, because an increase 
in interest rates could cause a significant loss for the bank. 
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Concept Checker Answers 


1. C Basel I and Basel 11.5 use VaR with a 99% confidence interval and the FRTB uses the 

expected shortfall with a 97.5% confidence interval. Basel I market risk capital requirements 
produced a very current result because the 10-day horizon incorporated a recent period of 
time. The FRTB does not require adding a stressed VaR to the expected shortfall calculation. 
It was Basel II.5 that required the addition of a stressed VaR. 

2. C The VaR measure would show a $0 loss because the probability of default is less than 5%. 

Having a 3% probability means that three out of five times, in the tail, the portfolio will 
experience a total loss. The potential loss is $495 million (= 3/5 x $825 million). 

3. D The expected shortfall is based on a waterfall of the liquidity horizon categories and is then 

scaled to the square root of the difference in the horizon lengths of the nested risk factors. 

4. C The criteria for classification as a trading book asset are: (1) the bank must be able to 

physically trade the asset, and (2) the bank must manage the associated risks on the trading 
desk. 

5. B The two types of risk recognized by the incremental risk charge are: (1) credit spread risk, 

and (2) jump-to-default risk. Jump-to-default risk is measured by 99% VaR and not 97.5% 
expected shortfall. 
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Exam Focus 

This topic focuses on the Basel Committees recommendations for identifying, assessing, 
and managing the risks associated with money laundering and the financing of terrorism 
(ML/FT) through banks. The concept of customer due diligence (CDD) is important and 
focuses on the precautionary steps a bank must take to ensure it knows the true identities 
of the customers with which it is dealing. Because many of the higher risk situations arise 
out of international, cross-border transactions, much of the recommendations focus on 
the risks associated with these activities. For the exam, understand who bears the ultimate 
responsibility for customer identification and verification, even if a third party is hired to 
carry out CDD. Also, know the responsibilities of both the correspondent and respondent 
banks in a correspondent banking relationship. 


Best Practices 


LO 61.1: Explain best practices recommended by the Basel Committee for the 
assessment, management, mitigation, and monitoring of money laundering and 
financial terrorism (ML/FT) risks. 


The Basel committee (referred to as the Committee) is committed to combating money 
laundering (ML) and the financing of terrorism (FT) as part of its mandate to enhance 
worldwide financial stability via a strengthening of regulation, supervision, and bank 
practices. The Committee has a long-standing commitment to sound Anti-Money 
Laundering and Countering Financing of Terrorism (AML/CFT) policies and procedures 
in banks. Banks without sound ML/FT risk management practices are exposed to serious 
risks including, but not limited to: reputational, operational, compliance, and concentration 
risks. Costs associated with these risks include fines and sanctions by regulators, the 
termination of wholesale funding and facilities, claims against the bank, loan losses, asset 
seizures, asset freezes, and investigative costs. 

Risk Assessment 

The Committees Core Principles for Effective Banking Supervision was updated in 2012 and 
requires that all banks, “have adequate policies and processes, including strict customer 
due diligence (CDD) rules to promote high ethical and professional standards in the 
banking sector and prevent the bank from being used, intentionally or unintentionally, for 
criminal activities.” Sound risk management means the bank must identify and manage 
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ML/FT risks, designing and implementing policies and procedures corresponding to the 
identified risks. These risks must be assessed at the country, sector, bank, and business 
relationship levels. The bank must have policies and procedures for: 

• Customer identification. 

• Customer due diligence. 

• Customer acceptance. 

• Monitoring of business relationships. 

• Monitoring of business operations. 

The bank must develop a thorough understanding of ML/FT risks present in: 

• The customer base. 

• The banks products and services. 

• The delivery channels for products and services, including products and services in the 
development stage. 

• The jurisdictions within which the bank and the banks customers do business. 

The banks understanding of inherent ML/FT risks is based on both internal and external 
data sources, including operational and transaction data (internal) and national risk 
assessments and country reports from international organizations (external). 

Risk Management 

Proper governance arrangements are necessary for the management of ML/FT risks. 

Prior publications from the Committee (specifically. The Internal Audit Function in 
Banks, June 2012, Principles for Enhancing Corporate Governance, October 2010, and 
Compliance and the Compliance Function in Banks, April 2005) describe proper governance 
arrangements. In particular, these publications require the board of directors to approve 
and oversee risk policies, risk management activities, and compliance. These functions 
are critical to the management and mitigation of ML/FT risks. ML/FT risk assessments 
must be communicated to the board of directors in a timely, complete, accurate, and 
understandable manner. 

The board of directors and senior management should appoint a qualified chief AML/ 

CFT officer with the stature and authority to garner the attention of the board, senior 
management, and business lines when ML/FT issues arise. 

Risk Mitigation 

First line of defense. The business units (e.g., the front office and customer facing activities) 
are the first line of defense in identifying, assessing, and controlling ML/FT risks. Policies 
and procedures should be specified in writing and communicated to bank personnel. 

Employees should know what they are supposed to do and how to comply with regulations. 

There should be procedures in place for detecting and reporting suspicious transactions. 

High ethical and professional standards are essential. The bank should carry out employee 
training on how to identify and report suspicious transactions. 

Second line of defense. The chief officer in charge of AML/CFT is the second line of defense. 

The officer should engage in ongoing monitoring and the fulfillment of AML/CFT duties. 

The officer should be the contact person for AML/CFT issues both internally and externally 
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[e.g.j supervisory authorities and financial intelligence units (FIUs)]. To avoid conflicts of 
interest, the officer should not have business line responsibilities or be responsible for data 
protection or internal audits. The officer may also be the chief risk officer and should have a 
direct reporting line to senior management and/or the board of directors. 

Third line of defense. The third line of defense is internal audits. The bank should establish 
policies for conducting internal audits of the banks AML/CFT policies. External audits 
may also play a role in evaluating a banks policies and procedures with respect to the 
AML/CFT function. 

Risk Monitoring 

The banks risk monitoring systems should be commensurate with the banks size, activities, 
and complexity. For most banks, and especially for banks that are internationally active, 
some of the monitoring activities will be automated. A bank must document its decision 
to forgo information technology (IT) monitoring and demonstrate an effective alternative. 
Monitoring systems should be able to provide accurate information to senior management 
on issues such as changes in the transactional profiles of bank customers. The IT system 
should also enable a bank to determine its own criteria for monitoring and filing suspicious 
transaction reports (STR) or taking other steps to minimize ML/FT risks. Internal audits 
should evaluate the effectiveness of IT monitoring systems. 


LO 61.2: Describe recommended practices for the acceptance, verification, and 
identification of customers at a bank. 


Customer Acceptance 

Banks must determine which customers pose a high risk of ML/FT. Factors the bank should 
consider include the customers: 

• Background. 

• Occupation including public and/or high profile figures. 

• Business activities. 

• Sources of income and wealth. 

• Country of origin. 

• Country of residence, if different from country of origin. 

• Choice and use of bank products and services. 

• Nature and purpose of the bank account. 

• Linked accounts. 

For lower-risk customers, simplified assessment procedures may be used (e.g., a customer 
with low balances who uses the account for routine banking needs). Also, the customer 
acceptance standards must not be so restrictive that they deny access to the general public, 
especially financially or socially disadvantaged persons. 

Enhanced due diligence may be required for: 

• Accounts with large balances and regular cross-border wire transfers. 

• A politically exposed person (PEP), especially foreign PEPs. 
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Banks must determine the risks they are willing to accept in order to do business with 
higher-risk customers. The bank must also determine the circumstances under which it will 
not accept a new business relationship or will terminate an existing relationship. 

Customer Verification 

The Financial Action Task Force (FATF) Recommendation 10 defines a customer as any 
person entering into a business relationship with a bank or carrying out an occasional 
financial transaction with a bank. Banks must, according to FATF standards, identify 
customers and verify their identity. Banks must establish a systematic procedure for 
identifying and verifying customers. In some cases, the bank must identify and verify a 
person acting on behalf of a beneficial owner(s). 

In terms of verification of a persons identity, the bank must be aware that the best 
documentation is that which is difficult to forge or to obtain illicitly. A bank may require a 
written declaration of the identity of a beneficial owner but should not rely solely on such 
a declaration. A bank must not forgo identification and verification simply because the 
customer cannot be present for an interview. The bank should pay particular attention to 
customers from jurisdictions that are known to have AML/CFT deficiencies. Enhanced due 
diligence is called for in these circumstances. 

Customer Identification 

In order to develop customer risk profiles (or categories of customers), the bank should 
collect data pertaining to the: 

• Purpose of the relationship or of the occasional banking transaction. 

• Level of assets. 

• Size of the transactions of the customer. 

• Regularity or duration of the banking relationship. 

• Expected level of activity. 

• Types of transactions. 

• Sources of customer funds, income, or wealth (if necessary). 

The bank should identify “normal” behavior for particular customers or categories of 
customers and activities that deviate from normal and might be labeled unusual or 
suspicious. 

Customer identification documentation may include: 

• Passports. 

• Identity cards. 

• Driving licenses. 

• Account files such as financial transaction records. 

• Business correspondence. 

If the bank cannot perform CDD, it should not open the account or perform a transaction. 

If the bank must, so as to not interrupt the normal conduct of business, engage in a business 
transaction prior to verification, and ultimately cannot verify the customers identity, then 
the bank should consider filing an STR. The customer should not be informed that the STR 
has been or will be filed, either directly or indirectly. 
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If the bank believes a customer has been refused banking services from another bank due to 
concerns about illicit activities, the bank should consider classifying the customer as high 
risk and engage in enhanced CDD or reject the customer altogether. If the customer insists 
on anonymity (or gives an obviously fictitious name), the bank should refuse to accept the 
customer. Numbered accounts may provide a level of confidentiality for a customer, but the 
bank must still verify the identity of the account holder. 

Ongoing monitoring of customer accounts and vigilant record-keeping are necessary to 
ML/FT risk management. 


LO 61.3: Explain practices for managing ML/FT risks in a group-wide and 
cross-border context, and describe the roles and responsibilities of supervisors in 
managing these risks. 


ML/FT Risk Management for Cross-Border Banks 

When a bank operates in multiple jurisdictions, it is subject to numerous country 
regulations. Each banking group {group refers to an organizations one or more banks 
and the branches and subsidiaries of the bank(s)] should develop group-wide AML/ 

CFT policies and procedures and consistently apply those policies across the groups 
international operations. Policies should be consistently applied (and supportive of the 
groups broader policies and procedures regarding ML/FT risks) even if requirements differ 
across jurisdictions. If the host jurisdictions requirements are stricter than the groups home 
country, the branch or subsidiary should adopt the host jurisdiction requirements. 

If a host country does not permit the proper implementation of FATF standards, then the 
chief AML/CFT officer should inform home supervisors. In some instances, the bank may 
need to close operations in the host country. 

In a cross-border context, AML/CFT procedures are more challenging than other risk 
management processes because some jurisdictions restrict a banks ability to transmit 
customer names and balances across national borders. However, for risk management 
purposes, it is essential that banks be able to, subject to legal protections, share information 
about customers with head offices or the parent bank. 

Risk assessment and management activities, such as customer risk assessments, group-wide 
risk assessments, and internal and external audits, apply to multi-national banks. When 
business is being referred to a bank, the banks own AML/CFT standards must be used in 
place of the jurisdiction of the referring bank, unless the introducer is in a jurisdiction with 
equal or stricter standards and requirements. 

Banks involved in cross-border activities should: 

• Integrate information on the customer, beneficial owners of the customer, and the funds 
involved in the transaction(s). 

• Monitor significant customer relationships, balances, and activity on a consolidated basis 
whether the account is on- or off-balance sheet, as assets under management (AUM), or 
on a fiduciary basis. 
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• Appoint a chief AML/CFT officer for the whole group who must ensure group-wide 
compliance (across borders) of AML/CFT requirements. 

• Oversee the coordination of group-wide information sharing. The head office should 
be informed of information regarding high-risk customers. Local data protection and 
privacy laws must be considered. 

For larger banks, the ability to centralize bank processing systems and databases may allow 

for more effective and efficient risk management. 

Role of Supervisors 

Bank supervisors are expected to: 

• Comply with FATF Recommendation 26 and apply the Core Principles for Effective 
Banking Supervision as it relates to the supervision of AML/CFT risks. FATF states the 
principles that are relevant to money laundering and the financing of terrorism. 

• Set out supervisory expectations governing banks’ AML/CFT policies and procedures. 

• Adopt a risk-based approach to supervising banks’ ML/FT risk management systems. To 
that end, supervisors must: 

♦ Understand the risks present in other jurisdictions and the impact on the supervised 
banks. 

♦ Evaluate the adequacy of the bank’s risk assessment based on the jurisdiction’s 
national risk assessments. 

♦ Assess the bank’s risks in terms of the customer base, products and services, and 
geographical locations in which the bank and its customers do business. 

♦ Evaluate the effectiveness in implementation of the controls (e.g., CDD) designed 
by the bank to meet AML/CFT obligations. 

♦ Allocate resources to conduct effective reviews of the identified risks. 

♦ Protect the integrity of the financial system by protecting the safety and soundness 
of banks relative to ML/FT risk management. This means making it clear that 
supervisors will take action, action that may be severe and public, against banks 
and their officers who fail to follow their own internal procedures and regulatory 
requirements. 

♦ Make sure the stricter of two jurisdictions’ requirements is applied. 

♦ Verify a bank’s compliance with group-wide AML/CFT policies and procedures 
during on-site inspections. 

♦ Extend full cooperation and assistance to home-country supervisors who need 
to assess a bank’s overseas compliance with group-wide AML/CFT policies and 
procedures. 

♦ Ensure there is a group audit and determine the scope and frequency of audits of the 
group’s AML/CFT risk management procedures. 

♦ Ensure the confidentiality of customer information provided to supervisors. 

♦ Make sure that supervisors are not classified as “third parties” in countries where 
there are restrictions on the disclosure of customer information to third parties. 
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LO 61.4: Explain policies and procedures a bank should use to manage ML/FT 
risks in situations where it uses a third party to perform customer due diligence 
and when engaging in correspondent banking. 


In some countries banks may rely on third parties to perform CDD. These third parties 
may be other financial institutions or designated non-financial businesses and professionals 
who are supervised or monitored for AML/CFT purposes. The FATF standards allow banks 
to rely on third parties for: 

1. Identifying the customer and verifying the customer s identity using reliable, 
independent information. 

2. Identifying and verifying the identity of the beneficial owner. 

3. Understanding and obtaining information on the purpose of the intended nature of the 
business relationship. 

The bank, relying on a third party to perform these functions, should immediately obtain 
the information concerning the CDD. 

Banks may outsource CDD obligations, and generally fewer restrictions apply in terms 
of who can act as the agent of the bank. The lower level of restrictions is offset by record¬ 
keeping requirements. 

Reliance on a Third Party 

Reliance on a third party does not relieve the bank of its responsibilities in terms of CDD 
and other AML/CFT requirements on customers. Relevant criteria for assessing reliance on 
a third party include: 

• The third party should be as comprehensively regulated and supervised as the bank. 
Alternatively, national laws may require the use of compensating controls where these 
standards are not met. 

• There should be a written agreement between the parties acknowledging the banks 
reliance on the third party for its CDD. 

• The banks policies and procedures must acknowledge this arrangement and establish 
adequate controls and review processes for the third party arrangement. 

• The third party should implement the banks AML program, and may be required to 
certify that it has done so and that it performs CDD equivalent to the banks obligations 
and requirements. 

• The bank should be aware of adverse publicity regarding the third party, such as 
enforcement actions for AML deficiencies or violations. 

• The bank should identify and mitigate risks posed by relying on a third party for CDD 
rather than maintaining a direct relationship with the customer. 

• The banks risk assessment should acknowledge the potential risk factors produced by 
relying on a third party for CDD. 

• The bank should periodically review the third party’s CDD and should obtain 
documentation from the third party that it relies upon and assesses the due diligence 
processes and procedures, ensuring that the third party is complying with local 
regulatory requirements by screening against local databases. 
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• The bank should terminate the relationship with a third party that does not apply 
adequate CDD on their customers or fails in some way to meet the banks requirements 
or expectations. 

If a bank relies on another financial institution in the group to introduce it to customers 
in other countries, the institution must ensure that the customer identification by the 
introducer complies with the previously listed criteria. 

Outsourcing/Agency 

Banks may engage in CDD directly or outsource the activity, sometimes in an agent 
relationship. If outsourced, it does not relieve the bank of its compliance responsibilities, 
which still lie with the bank. Banks that work more over the phone or internet and/or have 
few “brick and mortar” branches tend to use third parties to a greater extent. Banks often 
use retail deposit brokers, mortgage brokers, and solicitors to apply and meet their customer 
identification obligations. A written agreement between the parties should set forth the 
AML/CFT obligations of the bank and explain how they will be executed by the third party. 

The written agreement should include the following requirements that the: 

• Banks customer identification and CDD requirements be applied by the agent. 

• Agent use original identification documents to identify the customer when the customer 
is present in person. 

• Third party adheres to the banks policies when the customer is not present at the time of 
customer identification. 

• Customers information remains confidential. 

In addition, the bank should: 

• Ensure that the agent or third party determines the identity of beneficial owners or PEPs. 

• Ensure that the agent or third party provides the bank with customer identification 
information in the required time frame. 

• Review and audit the quality of the customer information that is gathered and 
documented. 

• Clearly identify instances the bank would consider failures to perform the contracted 
duties. 

• Ensure that data provided by the third party is complete, accurate, and timely. 

An agent, under the law of agent and principal, is generally considered a legal extension 
of the bank. This means the customer is legally dealing with the bank itself and the agent 
is, therefore, obligated to apply the banks policies and procedures regarding customer 
identification, verification, and CDD. 

The third party must have technical expertise, knowledge, and training regarding customer 
identification and CDD. In some cases, the third party is not subject to AML/CFT 
obligations itself. Even if the agent does not have AML/CFT obligations, it must apply 
the principals identification and CDD requirements, and conform to the principals legal 
requirements. 
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Correspondent Banking - A Risk Based Approach 

Correspondent banking relationships allow the respondent bank to provide services 
that it could not otherwise provide. According to the FATF, a correspondent banking 
relationship is ongoing and repetitive in nature. Cross-border correspondent banking 
involving the execution of third party payments is higher risk and, according to 
FATF Recommendation 13, should prompt additional CDD measures. Cross-border 
correspondent relationships allow respondent banks without international presence or cross- 
border payment systems to operate in jurisdictions to which they would otherwise not have 
access. 

The correspondent bank does not generally have a direct relationship with the respondent 
banks customers. They are in fact the customers of the respondent bank and, thus, the 
correspondent bank must conduct due diligence on the respondent bank, but not on the 
respondent banks customers. The respondent bank must conduct CDD. However, this 
also means the correspondent bank may be exposed to greater ML/FT risks because of 
limited information regarding the nature and purpose of the underlying transactions of the 
respondent banks customers. 

Risk indicators arising from cross-border correspondent banking include: 

• The inherent risks resulting from the nature of the services provided by the 

correspondent bank including: 

♦ The purpose of the services provided (e.g., foreign exchange services for proprietary 
trading, securities trading on exchanges, and so on may indicate lower risk). 

♦ Whether the services will be used via nested (downstream) correspondent banking 
by bank affiliates or third parties, and the risks that doing business with these parties 
entail. Nested (or downstream) refers to the use of correspondent banking services 

by a number of respondent banks through the relationship with the correspondent 
banks direct respondent bank to conduct financial transactions and gain access to 
services. 

♦ Whether services will be used via payable-through account(s) activity by the 
respondent banks affiliates or third parties and the risks these parties introduce. 

• The characteristics of the respondent bank, including the respondent banks: 

♦ Major business activities (e.g., target markets, types of customers served, key business 
lines). 

♦ Management and ownership. 

♦ Money laundering prevention and protection policies and procedures such as the 
CDD processes. 

♦ History, including whether any sanctions, criminal, civil, or administrative actions 
have occurred and how it was addressed by the respondent bank. 

• The environment in which the respondent bank operates, including: 

♦ The jurisdiction of the respondent bank and its parent. 

♦ The jurisdiction of the subsidiaries and branches of the group. 

♦ The quality and effectiveness of bank regulation and supervision in the respondent 
banks country. 
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Nested (Downstream) Correspondent Banking 

Nested or downstream correspondent banking is necessary and generally legitimate. 

Regional banks can assist small, local banks in the respondents region to gain access to the 
international financial system. However, these foreign institutions are not customers of the 
correspondent bank and, as they are not known, may increase ML/FT risks. The respondent 
bank should, therefore, disclose whether accounts include nested relationships. The 
correspondent bank should assess the risks on a case-by-case basis. Correspondent banks 
should consider: 

• The number and types of financial institutions the respondent bank serves. 

• The jurisdiction of the nested institutions and whether those jurisdictions have adequate 
AML/CFT policies according to available public information. 

• The types of services the respondent bank offers the nested institutions. 

• The length of the relationship between the correspondent and respondent banks. 

• The adequacy of the due diligence processes and procedures of the respondent bank. 

The correspondent bank should gather information about the respondent bank before 
entering a business relationship. Information about the respondent banks AML/CFT 
policies is essential and can be gathered from the respondent bank. The correspondent bank 
may use third-party databases (referred to as know your customer or KYC utilities) at account 
opening and must update this information over time. Correspondent banks may also use 
public sources to gather information. The correspondent bank should also consider relevant 
information on the jurisdiction in which the respondent resides before entering into a 
banking relationship. 

The level of due diligence should be commensurate with the respondent banks risk profile. 

The correspondent bank should assess the risk and the respondent banks AML/CFT 
controls by gathering information, checking the functioning of the internal audit, and so 
on. Correspondent banks should not engage in a relationship with a “shell” bank (i.e., one 
that has no physical presence in a jurisdiction and no affiliation with a regulated financial 
group). 

Banks should engage in ongoing monitoring activities of respondent banks. If a transaction 
is suspicious, the correspondent bank can issue a “request for information” on the 
transaction. 

In cross-border wire transfers, the Committee encourages all banks to apply high 
transparency. Payment messages must be in the correct form and must identify the 
originator and the beneficiary of the payment, and then must be monitored by those in the 
payment chain. The respondent bank, acting as the ordering financial institution, remains 
responsible for performing CDD. It is essential that the information in payment messages 
unambiguously identifies the originator and the beneficiary of the payment. 
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Professor's Note: Payment messages are the written instructions that go along 
with payments. There are messages when a payment is due, issued, canceled. 


and so on. Payment messages also contain information on the originator of 
the payment and the beneficiary. The Committee requires that everyone in the 
payment chain monitor the payments they process based on the information in 
the payment messages. This should in turn increase transparency and lower the 
ML/FT risk. 


If a respondent bank has a relationship with several entities in the same group, then risk 
assessments by different entities must be consistent with the group-wide risk assessment 
policy. The group s head office should coordinate the monitoring of the relationship with 
the respondent bank. This is especially important in the case of high-risk relationships. If 
the relationship is with the same group but in different host countries, the correspondent 
bank must assess the ML/FT risks presented in each business relationship. 
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Key Concepts 


L0 61.1 

To assess money laundering and the financing of terrorism (ML/FT) risks, the bank must 
know the identities of its customers and must have policies and procedures for: 

• Customer identification. 

• Customer due diligence (CDD). 

• Customer acceptance. 

• Monitoring of business relationships. 

• Monitoring of business operations. 

To mitigate ML/FT risks, the first line of defense is the business units (e.g., the front office 
and customer facing activities). They identify, assess and control ML/FT risks through 
policies and procedures that should be specified in writing and communicated to bank 
personnel. The second line of defense is the chief officer in charge of anti-money laundering 
and countering financing of terrorism (AML/CFT). The officer should engage in ongoing 
monitoring and the fulfillment of AML/CFT duties. The third line of defense is internal 
audits. The bank should establish policies for conducting internal audits of the banks 
AML/CFT policies. 


L0 61.2 

Banks must determine which customers pose a high risk of ML/FT. Factors the bank should 
consider include the customer s background, occupation, sources of income and wealth, the 
country of origin and the country of residence, the choice and use of the banks products 
and services, the nature and purpose of the bank account, and any linked accounts. Banks 
must, according to the Financial Action Task Force (FATF) standards, identify customers 
and verify their identities. Banks must establish a systematic procedure for identifying 
and verifying customers. In some cases, the bank must identify and verify a person acting 
on behalf of a beneficial owner(s). Customer identification documentation may include 
passports, identity cards, driving licenses, and account files such as financial transaction 
records and business correspondence. 


L0 61.3 

Banks involved in cross-border activities should: 

• Integrate information on the customer, beneficial owners of the customer (if one exists), 
and the funds involved in the transaction(s). 

• Monitor significant customer relationships, balances, and activity on a consolidated basis 
whether the account is on- or off-balance sheet, as assets under management (AUM) or 
on a fiduciary basis. 

• Appoint a chief AML/CFT officer for the whole group (the group of banks and branches 
that are part of one financial organization) who must ensure group-wide compliance 
(across borders) of AML/CFT requirements. 

• Oversee the coordination of group-wide information sharing. The head office should 
be informed of information regarding high-risk customers. Local data protection and 
privacy laws must be considered. 
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Bank supervisors must comply with FATF Recommendation 26 and apply the Core 
Principles for Effective Banking Supervision as it relates to the supervision of AML/CFT risks. 
FATF states the principles that are relevant to money laundering and financing of terrorism. 
They must also set out supervisory expectations governing banks’ AML/CFT policies and 
procedures and should adopt a risk-based approach to supervising banks’ ML/FT risk 
management systems. 


L0 61.4 

In some cases, banks rely on third parties to perform CDD. The FATF standards allow 
banks to rely on third parties to (1) identify the customer and verify the customer’s identity 
using reliable, independent information, (2) identify and verify the identity of the beneficial 
owner, and (3) understand and obtain information on the purpose and the intended nature 
of the business relationship with the customer. However, reliance on a third party does not 
relieve the bank of its responsibilities in terms of CDD and other AML/CFT requirements 
on customers. 

Banks may engage in CDD directly or outsource the activity, sometimes in an agent 
relationship. If outsourced, it does not relieve the bank of its compliance responsibilities, 
which still lie with the bank. 

Correspondent banking relationships allow the respondent bank to provide services that 
it could not provide otherwise. Risk indicators arising from cross-border correspondent 
banking include the inherent risks resulting from the nature of the services provided by the 
correspondent bank including the characteristics of the respondent bank, which involve the 
respondent bank’s major business activities and the environment in which the respondent 
bank operates. 

Nested (or downstream) refers to the use of correspondent banking services by a number 
of respondent banks through the relationship with the correspondent bank’s direct 
respondent bank to conduct financial transactions and gain access to services. The foreign 
institutions (respondent banks) are not customers of the correspondent bank and, as they 
are not known, may increase ML/FT risks. The respondent bank should, therefore, disclose 
whether accounts include nested relationships and monitor accordingly. In cross-border 
wire transfers, the Committee encourages all banks to apply high transparency. Payment 
messages must be in the correct form and must identify the originator and the beneficiary of 
the payment, and then must be monitored by those in the payment chain. 
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Concept Checkers 


1. Which of the following is an example of external data that the chief Anti-Money 
Laundering and Countering Financing of Terrorism (AML/CFT) officer should 
analyze and understand in order to manage and mitigate money laundering and the 
financing of terrorism (ML/FT) risks? 

A. Transaction data. 

B. Payment message streams. 

C. Country reports. 

D. Customer passports and identity card. 

2. With respect to managing and mitigating money laundering and the financing 
of terrorism (ML/FT) risks in a bank, bank tellers and branch managers are 
examples of: 

A. the first line of defense. 

B. the second line of defense. 

C. the most important line of defense. 

D. lower level bank employees that have little to do with financial crimes risk 
management. 

3. The risk manager of a large U.S. multi-national bank is attempting to put in greater 
risk controls. In keeping with recommendations from the Basel Committee on 

the sound management of risks related to money laundering and the financing of 
terrorism (ML/FT) she requires enhanced customer due diligence (CDD) for: 

A. all accounts from customers initiated in countries outside the United States. 

B. accounts with regular cross-border wire transfers. 

C. individual accounts with balances less than the $250,000 Federal Deposit 
Insurance Corporation (FDIC) insurance limit. 

D. accounts of persons who reside in countries other than their countries of birth. 

4. Which of the following is the role of a bank supervisor, acting in its role regarding 
the supervision of Anti-Money Laundering and Countering Financing of Terrorism 
(AML/CFT) risks? 

A. Require all banks to use the same global payment systems to make detection of 
irregularities simpler. 

B. Make sure all banks have a chief AML/CFT risk manager that reports directly to 
the board of directors. 

C. Require all banks to provide daily documentation to the supervisor on any cross- 
border wire transfers. 

D. Make sure the stricter of the two jurisdictions’ rules regarding ML/FT risks are 
applied by banks. 
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5. When a correspondent bank provides products or services to a respondent bank that 

then offers these services to other banks, it is known as: 

A. nested correspondent banking—it is legal but can increase the risks of money 
laundering and the financing of terrorism. 

B. upstream correspondent banking—it is illegal and will increase the risks of 
money laundering and the financing of terrorism. 

C. diversified correspondent banking—it is legal and does not increase the risks of 
money laundering and the financing of terrorism. 

D. downstream correspondent banking—it is illegal and will increase the risks of 
money laundering and the financing of terrorism. 
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Concept Checker Answers 


1. C The banks understanding of inherent money laundering and the financing of terrorism 

(ML/FT) risks is based on both internal and external data sources including operational 
and transaction data (internal) and national risk assessments and country reports from 
international organizations (external). 

2. A To mitigate ML/FT risks, the first line of defense is the business units (e.g., the front office 

and customer facing activities). They identify, assess, and control ML/FT risks through 
policies and procedures that should be specified in writing and communicated to bank 
personnel. The second line of defense is the chief officer in charge of AML/CFT. The third 
line of defense is internal audits. 

3. B Banks must determine which customers pose a high risk of ML/FT. Factors the bank 

should consider include the customers background, occupation, business activities, sources 
of income and wealth, country of origin, country of residence, if different from country 
of origin, choice and use of bank products and services, nature and purpose of the bank 
account, and any linked accounts. For lower-risk customers, simplified assessment procedures 
may be used (e.g., a customer with low balances who uses the account for routine banking 
needs). Enhanced due diligence may be required for: 

• Accounts with large balances and regular cross-border wire transfers. 

• A politically exposed person (PEP), especially foreign PEPs. 

4. D Bank supervisors have many jobs in conjunction with ML/FT risks, including complying 

with FATF Recommendation 26 and applying the Core Principles for Effective Banking 
Supervision as it relates to the supervision of AML/CFT risks. Supervisors should make sure 
the stricter of two jurisdictions’ requirements is applied. They do not, however, require banks 
to use the same payment systems, require daily documentation of cross-border wire transfers 
be submitted to the supervisor, or require banks to have a chief AML/CFT officer that 
reports to the board (although it is recommended that banks have an officer that reports to 
the board and/or senior management). 

5. A Nested (or downstream) refers to the use of correspondent banking services by a number of 

respondent banks through the relationship with the correspondent bank’s direct respondent 
bank to conduct financial transactions and gain access to services. Nested or downstream 
correspondent banking is necessary, legal, and generally legitimate. However, the foreign 
institutions are not customers of the correspondent bank and, as they are not known, may 
increase money laundering and the financing of terrorism (ML/FT) risks. 
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Self-Test: Operational and 
Integrated Risk Management 


10 Questions: 30 Minutes 

1. Outsourcing may reduce costs, provide expertise, expand bank offerings, 

and/or improve bank services. The board of directors and senior management must 
understand the operational risks that are introduced as a result of outsourcing. 

Which of the following actions is(are) suggested by the Basel Committee for 
controlling risks related to outsourcing? 

I. An agreement detailing termination rights and other rights and responsibilities 
of the two parties involved. 

II. Established policies for restitution in the event of failure on the part of an 
outside service provider. 

A. I only. 

B. II only. 

C. Both I and II. 

D. Neither I nor II. 

2. There are five major factors that could lead to a poor or fragmented IT infrastructure 
at an organization. Which of the following factors is least likely to result in a poor or 
fragmented IT infrastructure? 

A. Moderate turnover of key IT staff 

B. Participating in merger and acquisition activities. 

C. Management of a firm that is focused primarily on long-term projects. 

D. Allowing each business line the autonomy to upgrade their IT systems based on 
the best available resources. 

3. The generalized Pareto distribution is used for modeling extreme losses. The 

model requires the choice of a threshold. Which of the following best describes the 
tradeoffs in setting the threshold level? 

A. The threshold must be high enough so that the tail index indicates a heavy tail. 

B. The threshold must be high enough so that the tail index indicates a light tail. 

C. The threshold must be high enough so that convergence to the generalized 

Pareto distribution occurs. 

D. The threshold must be high enough so that there are enough observations to 
estimate the parameters. 
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4. Given the following data for a project, which of the following statements is most 
accurate regarding the use of the risk-adjusted return on capital (RAROC)? 


Equity beta: 

1.2 

Market return: 

13% 

Variance of returns: 

5% 

RAROC: 

16% 

Risk-free rate: 

4% 


I. Using the adjusted RAROC, the project should be rejected because the 
RAROC is less than the market return plus the risk-free rate. 

II. Using the adjusted RAROC, the project should be accepted because its 
adjusted RAROC is higher than the risk-free rate. 

A. I only. 

B. II only. 

C. Both I and II. 

D. Neither I nor II. 

5. You are holding 100 SkyTrek Company shares with a current price of $30. The daily 
mean and volatility of the stock return are 2% and 3%, respectively. VaR should be 
measured relative to initial wealth. The bid-ask spread of the stock varies over time, 
and the daily mean and volatility of this spread are 0.5% and 1%, respectively. Both 
the return and spread are normally distributed. What is the daily liquidity-adjusted 
VaR (LVaR) at a 99% confidence level assuming the confidence parameter of the 
spread is equal to 3? 

A. $103.50. 

B. $172.62. 

C. $193.15. 

D. $202.20. 

6. A recently published article on issues with value at risk (VaR) estimates included the 
following statements. 

Statement 1: Differences in the use of confidence intervals and time horizon 

can cause significant variability in VaR estimates as there is lack of 
uniformity in practice. 

Statement 2: Standardization of confidence interval and time horizon would 
eliminate most of the variability in VaR estimates. 

This articles statements are most likely correct with regard to: 

A. Statement 1 only. 

B. Statement 2 only. 

C. Both statements. 

D. Neither statement. 

7. Global Transportation, Inc., recently traded at an ask price of $45 and a bid price of 
$44.50. The sample standard deviation of the bid-ask spread was 0.0001. The 99% 
spread risk factor for a purchase of Global Transportation is closest to: 


A. 

0.0057. 

B. 

0.2541. 

C. 

25.41. 

D. 

0.1111. 
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8. The standardized model for market risk charges differs from the internal model- 

based approach in that the standardized model: 

A. sums up market risks across market risk categories, whereas the internal model- 
based approach uses a multiplicative factor on the average VaR. 

B. sums up market risks across market risk categories, whereas the internal model- 
based approach focuses solely on specific risk charges. 

C. focuses solely on specific risk charges, whereas the internal model-based 
approach sums up market risks across market-risk categories. 

D. uses a multiplicative factor on the average VaR, whereas the internal model- 
based approach sums up market risks across market risk categories. 

9. Given the following information, what is Bank Xs net stable funding ratio (NSFR) 


• 

High-quality liquid assets: 

$100 

• 

Required amount of stable funding: 

$200 

• 

Cash outflows over the next 30 days: 

$130 

• 

Net cash outflows over the next 30 days: 

$90 

• 

Available amount of stable funding: 

$210 

A. 

65%. 


B. 

89%. 


C. 

105%. 


D. 

125%. 



10. Global Bank has been unwilling to appoint a chief Anti-Money Laundering and 
Countering Financing of Terrorism (AML/CFT) officer. As a result, the bank 
has had several incidents involving money laundering, some of which have been 
reported on in the press. Which of the following is not a key risk associated with 
weak money laundering and the financing of terrorism (ML/FT) risk management 
practices? 

A. Market risk. 

B. Operational risk. 

C. Compliance risk. 

D. Concentration risk. 
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1. A Outsourcing policies should include: 

• Processes and procedures for determining which activities can be outsourced and 
how the activities will be outsourced. 

• Processes for selecting service providers (e.g., due diligence). 

• Structuring the outsourcing agreement to describe termination rights, ownership of 
data, and confidentiality requirements. 

• Monitor risks of the arrangement including the financial health of the service 
provider. 

• Implement a risk control environment and assess the control environment at the 
service provider. 

• Develop contingency plans. 

• Clearly define responsibilities of the bank and the service provider. 

The Basel Committee does not explicitly suggest establishing policies for restitution in the 
event of failure on the part of the outside service provider although this could be detailed in 
the outsourcing agreement. 

(See Topic 37) 

2. C Management of a firm that is focused less on short-term financial issues and more on 

long-term survival is much less likely to encounter problems with poor or fragmented IT 
infrastructures. Moderate turnover in IT staff, especially key staff, will likely contribute to the 
problem. Merger and acquisition activity will often result in multiple systems running at the 
same time so that data aggregation across products and business lines becomes a significant 
new challenge. Allowing autonomy to each business line will likely result in inconsistency 
across business lines and could be costly if the systems end up being incompatible due to the 
inconsistency. 

(See Topic 39) 

3. C The threshold must be high enough so that convergence to the generalized Pareto 

distribution occurs. Choices A and B are incorrect because the tail index is chosen by the 
researcher. Heavy tails are indicated by a tail index greater than zero. Choice D is incorrect 
because the threshold must be low enough so that there are enough observations to estimate 
the parameters. 

(See Topic 45) 
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4. B The adjusted RAROC (ARAROC) compares the adjusted RAROC to the risk-free rate. So 

Statement I is incorrect. 

The project should be accepted because the ARAROC of 5.2% is greater than the risk-free 
rate of 4%. So Statement II is correct. 

ARAROC = 0.16 - 1.2(0.13 - 0.04) = 0.052. 

(See Topic 48) 

5. D At the 99% confidence level, you would use an alpha statistic of 2.33 since VaR is a one- 

tailed test. The liquidity-adjusted VaR = normal VaR + adjustment for liquidity. 

Normal VaR = portfolio value x (mean - 2.33 x standard deviation) 

Normal VaR = 100 x $30 x (2% - 2.33 x 3%) 

Normal VaR = $149.70 (Note that a negative sign is implied here since we are dealing with 
the value at risk.) 

Liquidity adjustment = 0.5 x portfolio value (spread mean + 3 x spread volatility) 

Liquidity adjustment = 0.5 x $3,000 x (0.5% + 3x1%) = $52.5 
LVaR = $149.70 + $52.5 = $202.20 

(See Topic 52) 

6. A Statement 1 is correct as variability in risk measures, including lack of uniformity in the 

use of confidence intervals and time horizons, can lead to variability in VaR estimates. 
Statement 2 is incorrect as other factors can also cause variability, including length of the 
time series under analysis, ways of estimating moments, mapping techniques, decay factors, 
and number of simulations. 

(See Topic 53) 

7. A The formula for the expected transactions cost confidence interval is: 

+/- P X Vi(s + 2.33cr^) 
where: 

P = an estimate of the next day asset midprice, usually set to P, the most recent price 
observation. 

s = expected or typical bid-ask spread calculated as (ask price - bid price) / midprice 
Og = sample standard deviation of the spread 

The V^(s + 2.33a^) component of the confidence interval is referred to as the 99% spread risk factor. 

Midprice = (45 + 44.50) / 2 = 44.75 

s = (45-44.5)/44.75 = 0.0112 

spread risk factor = i/ 2 [ 0.0112 + 2.33(0.0001)] = 0.0057 

(See Topic 54) 

8. A The standardized model approach simply sums the market risks across the market-risk 

categories. The internal model-based approach applies a multiplicative factor to the average 
VaR. 

(See Topic 58) 


Page 336 


©2018 Kaplan, Inc. 



Book 3 

Self-Test Answers: Operational and Integrated Risk Management 


9. C The longer-term funding ratio is equal to the available amount of stable funding divided 

by the required amount of stable funding. Under Basel III, this ratio must equal or exceed 
100%. Bank As net stable funding ratio = $210 / $200 = 105%. 

(See Topic 59) 

10. A Banks without sound ML/FT risk management practices are exposed to serious risks 

including reputational, operational, compliance, and concentration risks. 

(See Topic 61) 
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Formulas 


Operational and Integrated Risk Management 


Topic 43 


basic indicator approach: 


^BIA — 


Ecii 

i=l 


XQ 


where: 

GI = annual (positive) gross income over the previous three years 
n = number of years in which gross income was positive 
a =15% (set by Basel Committee) 


the standardized approach: 


Ktsa 


y] max[y^(GIi_8x3i_8),0] 

3 Years 


3 


where: 

Glj g = annual gross income in a given year for each of the eight business lines 
3l 8 = beta factors (fixed percentages for each business line) 


Topic 44 

business indicator: 

BI = ILDC + SC + FC 

avg avg avg 

where: 

ILDC = interest, lease, dividend component 
SC = services component 

FC = financial component 
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internal loss multiplier: 


internal loss multiplier = In 


e ^-1 


loss component 
BI component 


where: 

loss component = 

7 X average total annual loss 

+ 7 X average total annual loss only including loss events above €10 million 
+ 5 X average total annual loss only including loss events above €100 million 


Topic 45 


generalized extreme value (GEV) distribution: 


F(X 1 = exp 

>-l/t 

^ . X — LL 

- l + ^x-^ 

(y J 

F(X 1 ^,|i„a) = exp 

/ \ 
X —Li 

exp 

1 (y 

II 


generalized Pareto distribution: 


1 - 


1 + 




- 1 /^ 


if ^^0 


1 — exp 


if ^ = 0 


Topic 48 
economic capital: 

economic capital = risk capital + strategic risk capital 


RAROC: 


RAROC = 


after-tax expected risk-adjusted net income 
economic capital 


RAROC = 


exp ected revenues — cos ts — exp ected losses 
— taxes + return on economic capital ± transfers^ 

economic capital 
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hurdle rate: 


^AT 


[(CExRce) + (PExRpe)| 
(CE + PE) 


where: 

CE = market value of common equity 
PE = market value of preferred equity 

= cost of common equity [could be derived from the capital asset pricing model 
(CAPM)] 

= cost of preferred equity (yield on preferred shares) 


adjusted RAROC: 

Adjusted RAROC = RAROC - (Rjy^ - Rp) 


Topic 52 


, (ask price — bid price) 

spread = - \^\ - 

(ask price + bid price) / 2 

liquidity-adjusted VaR (constant spread): 
LVaR = (V X X cr) + [0.5 x V x spread] 

LVaR = VaR+LC 
where: 

V = asset (or portfolio) value 
= confidence parameter 
a = standard deviation of returns 


lognormal VaR: VaR = [1 - exp(p -ax z^)] x V 


LVaR _ 2 ^ spread 

VaR 2 X [1 — exp(—a x Zq^ )] 
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elasticity: E = 


AP/P 

AN/N 


where: 

AN/N = size of the trade relative to the entire market 


LVaR = VaRx 


API 

= VaRx 

^ anI 

1- 

1 —Ex- 

P . 


N J 


LVaR 


VaR 


combined 


LVaR 


VaR 


exogenous 


LVaR 

X- 

VaR 


endogenous 


Topic 54 


leverage ratio: ^ ^ 


(E + D) , , D 
E E 


leverage effect: ROE = (leverage ratio x ROA) — [(leverage ratio — 1) x cost of debt] 

transactions cost confidence interval: +/— P x Viis + 2.330^ 
where: 

P = an estimate of the next day asset midprice, usually set to P, the most recent price 
observation 

s = expected or typical bid-ask spread 
= sample standard deviation of the spread 


spread risk factor: Viis + 2.33cr^) 


Topic 58 

credit equivalent amount: 
max(V, 0) + a X L 


where: 

V = current value of the derivative to the bank 
a = add-on factor 
L = principal amount 
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market risk capital requirement: 

max(VaR^_p m^ x VaR^^^) + SRC 
where: 

VaR^_^ = previous days VaR 

VaR^^g = the average VaR over the past 60 trading days 
m = multiplicative factor 

SRC = specific risk charge 

expected loss: 

EL = ^ EAD; X LGD; X PD; 

i 

required capital = EAD x LGD x (WCDR - PD) x MA 
where: 

MA = maturity adjustment = (1 + (M - 2.5) x b)l{\ - 1.5 x ^) 

M = maturity of the exposure 

b = [0.11852-0.05478 xln(PD)]2 

total capital = 0.08 x (credit risk RWA + market risk RWA + operational risk RWA) 


Topic 59 
stressed VaR: 


max(VaR^ p m^ x VaR^^^) + max(SVaR^_p m^ x SVaR^^^ 


avg' 


where: 

VaRj._ j = previous days VaR, 10-day time horizon, 99% confidence level 
VaR = the average VaR over the past 60 days, 10-day time horizon, 99% confidence 
level 

m^ = multiplicative factor, determined by supervisor, minimum value of three 

SVaR^_ j = previous days stressed VaR, 10-day time horizon, 99% confidence level 
SVaR^^g = the average stressed VaR over the past 60 days, 10-day time horizon, 99% 
confidence level 

m^ = stressed VaR multiplicative factor, determined by supervisor, minimum of 

three 

liquidity coverage ratio: 

high quality liquid assets / net cash outflows in a 30-day period > 100% 


net stable funding ratio: 

amount of available stable funding / amount of required stable funding > 100% 
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A 

ABCP conduits 218 

acceptable data 36 

add-on amount 269 

adjusted RAROC 136 

advanced IRB approach 278 

advanced measurement approach 78, 280 

adverse price impact 228 

adverse selection 228 

alternative standardized approach 77 

anchoring bias 52 

anxiety bias 52 

asset-liability management 217 
audit findings 7 
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B 

backtesting 273 
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bank holding companies 164 
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bid-ask spread 192 
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cash management 180 
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compliance risk 259 
comprehensive approach 275 
Comprehensive Capital Analysis and Review 
250 
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constant level of risk 292 
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D 

Damage to Physical Assets 46 

data aggregation 30 

data quality 35 

data quality inspection 38 

data quality scorecard 38 

data validation 38 

dealer banks 237 

delivery 44 

Delphi technique 52 

delta-gamma approximation 200 

depth 230 

diseconomies of scope 240 
Dodd-Frank 300 
due diligence 260 
duration-convexity mapping 208 
dynamic strategies 209 

E 

economic capital 19, 128, 131, 146 
economies of scope 240 
elasticity 198 
embedded leverage 224 
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enterprise risk management 15 
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execution 44 

Execution, Delivery, and Process Management 

44 
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expected losses 131 
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expected shortfall 99, 147, 308 
exposure at default 277 
external audits 318 
External Fraud 46 
external loss data 7, 61 
extreme value theory 96 

F 

Federal Insurance Office 300 

fed funds-GC spread 184 

Financial Stability Oversight Council 300 

financing of terrorism 316 

firm-wide VaR 18 

foundation IRB approach 278 

fractional-reserve bank 217 

fully diversified capital 137 

funding liquidity 216 


G 

gaming 52 
general collateral 184 

generalized extreme value (GEV) distribution 
97 

generalized Pareto distribution 98 
goodwill 131 
gross leverage 226 
gross loss 92 

H 

haircut 181, 220 
huddle bias 52 
human error 119 
hurdle rate 135 
hybrid approach 82 

I 

incremental default risk 312 
incremental default risk charge 292 
incremental risk charge 292, 312 
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inexpert opinion 52 

insurance 82 
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Internal Fraud 46 
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internal models approach (Solvency II) 283 
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inventory management 228 
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IT risk management policy 28 

J 

JPMorgan Chase 120 
jump-to-default risk 312 
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key performance indicators 7 
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legal risk 259 
Lehman Brothers 182 
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leverage ratio 222, 296 
liquidity 216 

liquidity-adjusted VaR 193 
liquidity at risk 199 
liquidity coverage ratio 297 
liquidity horizon 309 
liquidity management 180 
liquidity risk 181, 192, 208, 216 
lognormal distribution 80 
lognormal VaR 195 

London Whale 122 

Long-Term Capital Management 120 

loss component 89 

loss distribution approach 79 

loss events 43 

loss given default 277 

loss provisions 48 

loss threshold 47 
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Office of Credit Ratings 301 

Office of Financial Research 300 
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on-the-run 185 
open repos 181 

operational data governance 38 

operational risk 1, 207, 259 

operational risk capital requirements 73, 280 
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63 

operational risk governance 1 
operational risk management framework 6 
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OTC derivatives market 237 
outsourcing 9 
overnight repos 180 

M 

P 

mapping 208 

marginal capital 137 

margin loans 221 

market risk 207 

market risk capital 307 

market risk capital requirement 271 

mark-to-market 271 

maturity adjustment 278 

maturity mismatch 216 

merger arbitrage hedge funds 219 

minimum capital requirement 282 

modeling frequency 79 
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model risk 116, 206 

model validation 104 

money laundering 316 

money market mutual fund 219 
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Monte Carlo simulation 81 
multivariate EVT 100 

payment messages 325 
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Poisson distribution 80 
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probability of default 276 

Q 
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rebate 221 

recoveries 47 
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N 
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novation 241 
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risk appetite framework 25 
risk assessments 7, 260 
risk capital 128 

risk control self-assessment 7, 48 
risk data infrastructure 28 
risk-weigh ted assets 252, 268 
rollover risk 217 

s 

scenario analysis 7, 51, 81 
securities lending 221 
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simple approach 275 
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special collateral 184 
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standard deviation 147 
standardized approach (credit risk) 274 
standardized approach (operational risk) 75 
standardized approach (Solvency II) 282 
standardized measurement approach 86 
standardized measurement method (market risk) 
272 
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